Requirements for use of the BSN

In the Netherlands, these requirements have been set out in the GDPR Implementation Act. For example, Article 46 of the GDPR Implementation Act says that the BSN may only be used if a law says so.

Use of BSN within the government

The use of BSN by the government has been arranged in Article 10 of the Citizen Service Number (General Provisions) Act (Dutch abbreviation: Wabb). This Act says that governmental organisations are allowed to use the BSN if this is necessary for the performance of their public duty.

Use of BSN outside the government

Organisations outside the government are only allowed to use the BSN if a specific law says so. For example, the Processing of Personal Data in Healthcare (Additional Provisions) Act. This Act says that healthcare providers are obliged to use the BSN for a number of purposes.

Use of BSN in other cases

Article 46 of the GDPR Implementation Act also says that by order in council, other cases may be designated in which the BSN may be used.

Overview of organisations that are allowed to use the BSN

There is an overview of organisations that are allowed to use the BSN. This is the authorisation list of BSN-entitled parties that can be found on the website of the National Office for Identity Data (Dutch abbreviation: RvIG).

Consent does not apply for the use of the BSN

Sometimes, organisations are allowed to use someone's personal data if that person gives consent for this. This does not apply for the BSN. Organisations are only allowed to use the BSN if a law says that they are permitted to do so. If it is not in the law, then it is not permitted. Not even with consent.