The Dutch National Institute for Public Health and the Environment (Rijksinstituut voor Volksgezondheid en Milieu, hereinafter: ‘RIVM’) processes personal data in the course of carrying out its statutory duties and other activities.

This General Privacy Statement explains why RIVM processes personal data, the legal basis for doing so, and how we protect your privacy. It also informs you of your rights under the General Data Protection Regulation (hereinafter: ‘GDPR’) and indicates whom you can contact if you have any questions surrounding the processing of your personal data or the protection of your privacy.

Table of contents

What are privacy and personal data?

Privacy is the right to the protection of your private life. This includes the protection of your personal data.

The term ‘personal data’ refers to any information relating to an identified or identifiable natural person. Examples include a home address, telephone number or email address.

Certain types of personal data require additional protection because their processing may have a significant impact on an individual's privacy. These include, for example, information about a person’s health or religion. Under the GDPR, such data are classified as special categories of personal data and are subject to additional legal safeguards.

Laws and regulations: the GDPR and the RIVM Act

RIVM considers the careful and responsible handling of personal data to be of fundamental importance. Whenever we process personal data, we do so in accordance with the applicable laws and regulations.

The GDPR is the European legal framework governing the protection of personal data. In the Netherlands, the GDPR is supplemented by the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, hereinafter: ‘UAVG’).

Under the GDPR, organisations may process personal data only where there is a valid legal basis and the processing is lawful, fair and transparent.

The GDPR lists six legal bases for processing personal data: consent, performance of a contract, compliance with a legal obligation, the protection of vital interests of the data subject or others, performance of a task carried out in the public interest or in the exercise of official authority, and legitimate interests.

RIVM only processes personal data when it is permitted by law.

In most cases, RIVM processes personal data because this is required for the performance of its public tasks or  the exercise of official authority. These tasks are defined in legislation, including the RIVM Act (Wet op het RIVM). In such cases, RIVM may process your personal data without asking for your consent. The same applies when RIVM processes personal data  to comply with a legal obligation.

RIVM as an independent agency of the Dutch Ministry of Health, Welfare and Sport (VWS)

RIVM is an independent agency of the Dutch Ministry of Health, Welfare and Sport (hereinafter: ‘VWS’).

Under the GDPR, the Minister of Health, Welfare and Sport (hereinafter: ‘Minister’) is the controller for the processing of personal data by RIVM. This does not mean that the personal data processed by RIVM are stored by the Minister or are accessible to the Minister. Personal data are processed within RIVM's own information systems and only accessible to authorised persons.

Additional privacy statements

RIVM provides additional privacy statements for specific activities, programmes and research projects.

These additional privacy statements describe in more detail how personal data are processed in the context of specific activities. Examples include the Neonatal Heel Prick Screening Programme and the National Immunisation Programme.

An additional privacy statement may be relevant to you if, for example, you participate in one of our research projects or public health programmes, or if you are invited to take part in a vaccination programme.

Where applicable, these additional privacy statements supplement this General Privacy Statement.

If you participate in a research study, you will often also receive an informed consent form explaining how your personal data will be processed. Where relevant, this information  forms part of the privacy information provided to you alongside this General Privacy Statement.

Why RIVM processes personal data

RIVM works to promote a healthy population and a safe, healthy and sustainable living environment. To carry out this mission, we process personal data for the following purposes:

  • Advising on a clean, healthy and safe living environment
    RIVM provides advice on how to protect and improve public health and the living environment. To support this work, we conduct research and may process personal data where this is necessary. This may include health data.

    We also share our knowledge with others. Where necessary, this may involve sharing personal data in accordance with the applicable legal framework.
  • Preventing and controlling infectious diseases
    Infectious diseases are caused by bacteria, viruses, fungi or parasites.

    RIVM collects data and information about infectious diseases, conducts scientific research and provides advice on how they can be prevented and controlled. We work closely with healthcare providers, public authorities and other organisations in the Netherlands and abroad.

    Where necessary for these activities, RIVM may process and share personal data, including health data, in accordance with the law.
  • Research into healthcare, healthy lifestyles and public health programmes
    RIVM conducts research to support high-quality healthcare and healthy lifestyles. We use the results of this research to provide advice to government bodies, healthcare professionals and other stakeholders.

    We also carry out public health programmes on behalf of the Dutch government, such as the National Immunisation Programme.

    In addition, RIVM coordinates a number of national population screening programmes aimed at detecting or preventing diseases at an early stage. Where necessary for these programmes and related research, RIVM may process personal data, including health data.

    Coordinating these population screening programmes does not mean that RIVM has access to all personal data of everyone who participates in those programmes.

We take privacy into account

Scientific research forms an important part of RIVM's work. Protecting the privacy of participants is therefore an integral part of how we conduct our activities.

We process only the personal data that are necessary for the relevant purpose. RIVM does not publish research findings or include information in reports in a form that identifies individuals.

We do not make automated decisions

RIVM does not makedecisions about individuals based solely on automated processing, including profiling.

This means that decisions that may affect persons are not taken exclusively by automated systems without meaningful human involvement.

Personal data processed for other purposes

In some situations, RIVM processes personal data for purposes that are not strictly related to its statutory duties.

For example, we may process your personal data to send you a newsletter or to communicate with you about activities or services for which you have registered.

Whose personal data RIVM processes

Where necessary to carry out its duties, RIVM may process personal data relating to a wide range of individuals.

For example, we process personal data relating to participants in our research studies, public health programmes, vaccination programmes or prenatal screening programmes.

Research involving human participants may fall within the scope of the Dutch Medical Research Involving Human Subjects Act (Wet medisch-wetenschappelijk onderzoek met mensen, hereinafter: ‘WMO’). Research that falls under the WMO or the Dutch Embryos Act is reviewed by an independent committee of experts.

Depending on the type of research, this will be a Medical Research Ethics Committee (Medisch Ethische Toetsingscommissie, hereinafter: ‘METC’) or the Central Committee on Research Involving Human Subjects (Centrale Commissie Mensgebonden Onderzoek, hereinafter: ‘CCMO’).

The METC or (Central Committee for Research involving Human Subjects) assesses whether the privacy of participants in medical research is adequately protected. Research that requires ethical approval may only commence after the relevant committee has granted its approval.

RIVM may also process personal data relating to its own employees, employees of suppliers, visitors to RIVM premises, and individuals who have subscribed to our newsletters.

Types of personal data RIVM processes

Where necessary for the performance of our statutory duties, RIVM may process  personal data, including special categories of personal data.

The special categories of personal data processed most frequently by RIVM are health data. However, where necessary for the performance of our statutory duties, we may also process personal data relating to, for example, a person’s sex life or sexual orientation, racial or ethnic origin, genetic data or other special categories of personal data.

In addition to special categories of personal data, RIVM may process certain other types of sensitive personal data. For example, RIVM may process the Dutch citizen service number (Burgerservicenummer, hereinafter: ‘BSN’) for the administration of vaccination programmes where this is permitted by law.

How RIVM obtains personal data

RIVM may obtain personal data directly from you. For example, you may provide your personal data directly to us when participating in one of our research studies.

In other situations, we may receive personal data from another organisation. Examples include the following:

  • RIVM may receive your personal data from healthcare providers, such as your general practitioner, the Municipal Public Health Service (GGD), a Youth Healthcare organisation (JGZ) or a hospital. In some situations, your prior consent is required before these data may be shared with RIVM, for example where medical confidentiality must be waived.
  • RIVM may also receive your personal data from the Personal Records Database (Basisregistratie Personen, hereinafter: ‘BRP'), where this is required or permitted by law. For example, we may use these data to invite you to participate in the National Immunisation Programme, the Neonatal Heel Prick Screening, or the Prenatal Screening Programme for Infectious Diseases and Erythrocyte Immunisation.

The statutory duties of RIVM

RIVM's statutory duties are laid down in the RIVM Act (Wet op het RIVM). In some cases, these duties are further specified in other legislation, such as the Public Health Act (Wet publieke gezondheid), or are carried out on behalf of the Minister.

Processing of personal data for diagnostic purposes

In some situations, your healthcare provider may ask RIVM to carry out diagnostic testing as part of your medical care. For example, your healthcare provider may ask us to determine whether you have a particular disease or medical condition.

RIVM communicates the results of the diagnostic testing directly to your healthcare provider.

To perform diagnostic testing, RIVM requires certain personal data about you. We receive these data from your healthcare provider.

Your consent is not required for this processing activity. RIVM is permitted to process these personal data as part of the medical treatment agreement between you and your healthcare provider.

The specific personal data required depend on your healthcare provider’s request and on the type of diagnostic testing being performed.

Consent and the processing of personal data

If you participate in one of our research studies, RIVM will often ask for your informed consent. This means that you will participate in the research study only after:

  • You have received sufficient information about the research study, and;
  • You have agreed to participate in the research study.

In some situations, your healthcare provider may also ask for your consent before sharing your medical data with RIVM. For example, this may be necessary where medical confidentiality must be waived.

Even if you have given consent to your healthcare provider or to RIVM, we will process your personal data only where this is necessary for the purpose concerned and where there is a valid legal basis for doing so.

Whenever we ask for your consent, we will also explain how you can withdraw that consent and what the consequences of doing so may be.

RIVM may also process your personal data on the basis of your consent. For example, we may process your personal data to send you a newsletter.

Retention of personal data

RIVM does not retain your personal data for longer than necessary to carry out its duties.

Personal data are retained:

  • for as long as necessary to achieve the purpose for which they were collected;
  • for as long as required under the Dutch Public Records Act (Archiefwet), and;
  • never longer than permitted by law.

The applicable retention period depends on the purpose for which the personal data are processed.

For many of the research studies conducted by RIVM, personal data must be retained for up to 20 years after the research study has been completed.

Retention periods are often prescribed by law or other applicable legal requirements, such as the Dutch Medical Treatment Contracts Act (Wet op de geneeskundige behandelingsovereenkomst), the Dutch Public Records Act (Archiefwet), or applicable records retention schedules (Selectielijsten).

Sharing personal data

In some situations, RIVM may be required or permitted to share personal data with other organisations. For example, personal data may be shared with other research institutions, universities, government ministries, or Statistics Netherlands (Centraal Bureau voor de Statistiek (CBS)). 
Whenever RIVM shares personal data with other organisations, we do so carefully and in accordance with the GDPR. We make appropriate arrangements with the organisations with which we share personal data. Where necessary, we collaborate to ensure that your privacy remains adequately protected.

Agreements with other parties

In some situations, RIVM engages other organisations to carry out activities on its behalf. Under the GDPR, these organisations are referred to as processors.

Examples include organisations that conduct surveys or analyses on our behalf, or organisations that help us reduce the identifiability of personal data.

Whenever RIVM engages a processor, we enter into a written data processing agreement to ensure that personal data are processed securely, carefully and in accordance with the GDPR.

Where RIVM transfers personal data to a recipient outside the European Economic Area (EEA), we continue to comply with the GDPR. Where necessary, we implement additional safeguards together with the recipient to ensure that personal data remain protected to a standard equivalent to that required under the GDPR.

Your privacy rights

Under the GDPR, you have a number of privacy rights.

Our additional privacy statements explain, for each specific activity or programme, which rights apply and how you can exercise them.

Examples include the National Immunisation Programme, the COVID-19 Vaccination Information and Monitoring System and certain research studies.

Types of GDPR requests

Under the GDPR, you may have the right to:

  • request access to the personal data RIVM processes about you;
  • request the rectification of inaccurate personal data about you;
  • request the erasure of your personal data;
  • request the transfer of your personal data to another organisation (data portability);
  • request the restriction of the processing of your personal data;
  • object to the processing of your personal data.

How to submit a GDPR request

If you would like to submit a GDPR request or have any questions about your privacy rights, please contact us by email at AVG-RIVM@rivm.nl.

RIVM will respond to your request within one month. Where necessary, this period may be extended by up to two additional months. If an extension is required, we will inform you within the original one-month period.

Identity verification following a GDPR request

When you submit a GDPR request, RIVM must verify your identity before processing your request.

We will choose the most appropriate method to verify your identity. This may depend on the nature of your request. In some situations, you may be able to verify your identity by using DigiD.

For general GDPR requests, we will usually ask you to provide a copy of a valid identity document, such as your passport or driving licence. You can use the KopieID app to create a secure copy of your identity document using your smartphone. Further information about the KopieID app is available on the website of the Dutch Government.

In exceptional cases, we may ask you to visit RIVM in person to verify your identity. For example, this may be necessary if your request concerns special categories of personal data or personal data of a minor. This helps ensure that sensitive personal data are disclosed only to the person entitled to receive them.

Refusing a GDPR request

In some situations, RIVM may refuse a GDPR request.

For example, this may be the case where an exception under the GDPR applies, where personal data have been anonymised for scientific research and can no longer be linked to you, or where RIVM does not process personal data relating to you.

How we protect personal data

RIVM considers the confidential and careful handling of personal data to be of fundamental importance.

As part of the Dutch government, RIVM complies with the Government Information Security Baseline (Baseline Informatiebeveiliging Overheid, or ‘BIO’), the national information security standard for municipalities, water boards, provincial authorities and the central government.

RIVM implements appropriate technical and organisational measures to protect personal data. These measures may include encryption and access controls. We ensure that our information systems are appropriately secured and that access to personal data is restricted to employees who require it for the performance of their duties.

All RIVM employees are bound by a duty of confidentiality. In addition, they receive training and guidance on privacy and information security so that they know how to handle personal data safely, responsibly and in accordance with applicable laws and regulations.

Questions or complaints about the processing of personal data

If you have any questions about this General Privacy Statement, or if you believe that RIVM is not complying with this statement or has not complied with it in the past, please contact us by email at AVG-RIVM@rivm.nl.

Alternatively, you may write to:

RIVM Central Privacy Team 
Freepost 3270
3720 VB Bilthoven
The Netherlands

If you have a complaint about the way RIVM has processed your personal data, you can find more information about our complaints procedure and how to submit a written complaint on the RIVM website.

You may submit your complaint by email to AVG-RIVM@rivm.nl. You may also contact the Data Protection Officer (DPO) of the Dutch Ministry of Health, Welfare and Sport at FG-VWS@minvws.nl.

The Data Protection Officer of the Dutch Ministry of Health, Welfare and Sport operates independently and supervises the ministry’s compliance with the GDPR. As RIVM forms part of the Dutch Ministry of Health, Welfare and Sport, the ministry’s Data Protection Officer also supervises RIVM.

Under the GDPR, you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes to this General Privacy Statement and version history

RIVM reviews and updates this General Privacy Statement regularly. We do so to improve the information provided and to reflect changes in privacy legislation or other relevant developments.

This General Privacy Statement was last updated in August 2026.