Groningen Council Raises Privacy Concerns Over Zivver’s US Takeover
After Zivver was bought by US firm Kiteworks, councillors fear sensitive municipal and health data could fall under US legal access or be readable in some workflows.
Before we begin, a quick shoutout to our sponsor, Signaal:
Looking for housing in the Netherlands?
Signaal helps you skip the endless scrolling by tracking new listings from trusted platforms and alerting you when something matches your needs, all in one easy-to-use app.
Zivver, the secure-mail tool used by the municipality and GGD Groningen, has been bought by the American company Kiteworks. Many council parties are worried about what this means for privacy. They’ve asked the city which departments use Zivver, what alternatives exist, and whether stricter rules will be added to contracts.
Why People Are Concerned
Reporters have raised questions about Kiteworks’ links and whether some Zivver data could be readable before encryption in certain workflows. There’s also a general risk with US ownership: even if data sits in Europe, US laws can sometimes demand access. Zivver and Kiteworks say they follow EU rules, keep data in the EU, and use strong encryption.
The rules in short
Public bodies must protect sensitive data (e.g., health, social care).
Transfers to US providers are only allowed with proper safeguards.
Dutch healthcare and municipalities often require compliance with NTA 7516 for secure messaging.
What Can Groningen Do Now?
Make a list of all services using Zivver and what type of data they send.
Update risk checks: do a Data Protection Impact Assessment (DPIA) and a transfer impact assessment.
Tighten contracts: EU-only processing routes, clear key management, audits, incident reporting, and NTA-7516 proof.
Plan a fallback: keep Zivver running for essential services, but compare certified alternatives in case the city wants to switch.
This is no longer just an IT tool: it’s a trust and privacy decision. Clear risk checks, enforceable safeguards, and a backup plan will show whether Groningen keeps Zivver under stricter terms or moves to another secure-mail service.