Governance and digital security
Boards of educational institutions take decisions across a wide range of areas: from internal oversight and structuring collaborative arrangements to employee participation and data protection. A sound decision on the substance will only hold up if the legal framework supporting it is properly in place.
Governance and supervision in education
The demands placed on boards and supervisory board members by education legislation and case law are growing, both legally and in terms of public accountability. Clear provisions in articles of association, policies and internal regulations help to keep those roles sharply defined. Several themes deserve particular attention:
-
Acting independently and identifying conflicts of interest at an early stage.
-
Taking decisions and conducting oneself with integrity.
-
Managing conflicts within the board and the supervisory board in a controlled manner.
-
Maintaining compliance with the Senior Officials in the Public and Semi-Public Sector (Standards for Remuneration) Act (Wet normering topinkomens, WNT), including the annually indexed remuneration ceilings, the tax treatment of undue payments and publication in the annual report.
-
Establishing a tax governance structure, such as a tax control framework and any arrangements with the Tax and Customs Administration concerning cooperative compliance.
Collaboration structures and joint ventures in education
Educational institutions are collaborating with increasing frequency, with other institutions, healthcare and welfare organisations, and local and regional authorities. The key question is which legal form best suits the particular arrangement.
There are several routes available. Where collaboration is light and liability is limited, an administrative agreement without a separate legal entity may be sufficient. Where the collaboration is more intensive, a separate entity such as a foundation, association or cooperative is the more appropriate choice. Each form of collaboration carries its own implications for governance, supervision and co-determination.
The applicable governance codes also require attention. The Code of Good Governance for Universities contains a dedicated principle addressing collaborative arrangements and partnerships. Boards of universities of applied sciences must observe the principles set out in the Sector Code for Good Governance and Supervision in Higher Professional Education when entering into collaborative arrangements.
It is worth giving careful thought to the legal form at the outset. This avoids the need to revisit a valuable partnership at a later stage.
Co-determination and external supervision
Co-determination bodies hold a firmly established position in the education sector. The law grants them the right to be consulted on matters including the appointment and dismissal of senior management and board members, and the right of approval in relation to the institutional plan, examination regulations and complaints procedure. How an educational institution manages these relationships matters considerably. A proactive approach strengthens decisions and prevents processes from running into delay or having to be repeated.
The Inspectorate of Education, the Ministry of Education, Culture and Science and the Accreditation Organisation of the Netherlands and Flanders (NVAO) each play a distinct oversight role. The Inspectorate of Education focuses on quality, financial regularity and continuity; the Ministry on the system and funding arrangements; and the NVAO on the accreditation of programmes.
The manner in which contact with these bodies is managed can make a material difference. Engaging early, setting out the institution's own reasoning clearly and demonstrating visible follow-up on concerns generates greater room for manoeuvre in the long term.
GDPR, NIS2, and cybersecurity for educational institutions
Educational institutions process large volumes of data relating to students and staff. This data sits within a legal framework that combines strict notification deadlines and overlapping regulatory regimes. The GDPR has been in force for several years, and the European NIS2 Directive may, through the implementing Cybersecurity Act (Cyberbeveiligingswet), introduce additional requirements concerning security, incident response plans and incident reporting.
A fundamental question is where data is actually held. Storage with cloud service providers outside the EU remains an area of vulnerability, with direct consequences for reputation and trust in the event of a data breach or cyber incident. In practice, the following core issues are paramount:
-
Establishing clear data storage arrangements, with particular attention to US-based cloud services operating outside the EU.
-
Putting in place incident response plans and reporting procedures that meet the applicable notification deadlines.
-
Drafting contracts with cloud and other technology suppliers that adequately protect the institution's position.
-
Managing a data breach or cyber incident in a legally sound manner, with due regard for operational continuity and institutional reputation.
The first 24 hours following an incident frequently determine how events will unfold. The legal, technical and governance procedures must therefore already be in place before an incident occurs.
Would you like to speak directly with one of our specialists?
Our attorneys, notaries, and tax specialists work closely with one another and with you. Drawing on a broad perspective, we provide expert advice and concrete solutions that truly make a difference.
- Dedicated specialists
- A pragmatic approach
- Personal and prompt contact
