The Netherlands has 25 GGDs. GGD means: Gemeentelijke Gezondheidsdienst, or Municipal Public Health Service. The GGD helps keep people in the Netherlands healthy. Sometimes, we need to use personal data to do this. For example, if you are receiving a coronavirus vaccination. This statement explains:
This statement only concerns the use of your data for the coronavirus vaccination. The GGD uses data from people who have or make an appointment for a coronavirus vaccination.
The GGD uses your data to give you a coronavirus vaccination. We do this in several steps:
The GGD may also use your data for scientific research into the coronavirus. GGD GHOR Nederland (the national umbrella organisation of the GGDs and Regional Medical Assistance Organisations) assists the GGD in organising and implementing the coronavirus vaccination process.
The National Institute for Public Health and the Environment (RIVM) determines who is eligible for a coronavirus vaccination. It also sends out the invitations. If you then make an appointment, the GGD will use your data to enter the appointment into the computer system. This will enable us to help you more quickly on the day of the vaccination.
The GGD will send you a text message to remind you of your appointment. You may also receive other text messages from the GGD. For example, if your appointment has been cancelled or the time or location has changed.
Before you receive the coronavirus vaccination, the GGD is required to ask for and register your Citizen Service Number (BSN). The GGD will use your BSN to identify you.
The GGD will check whether it is medically responsible to give you the coronavirus vaccination. To do this, we use important medical information, such as your medical history, allergies and medication use. We do this at several points: when making the appointment by asking health questions and at the vaccination location with a questionnaire about your health. This way, we make sure that you can receive the vaccination safely.
At the vaccination location, we will first check your identity. We will then note the number of your identity document in your medical file. After that, we will ask you a few medical questions. We will also record important answers in your medical file. If there are no medical objections, you will receive the coronavirus vaccination. The details of the vaccination (such as date, vaccine and batch number) will be stored in your medical file in the CoronIT system. This will allow the GGD to know exactly when you received the vaccination and which vaccine was used.
You may experience side effects from the coronavirus vaccination. If this happens, we will record this in your medical file. We can then take this into account during your next appointment.
The GGD uses your data for scientific and statistical research into public health. Sometimes, the GGD conducts its own research. We may also share your data with research organisations such as RIVM. We only use and share data that cannot be traced back to you. This means that the researchers will not be able to see who the data belong to. Your name and other personal details will not be shared.
Would you rather not have your data be used for research?
If you do not want this, you can object to the use of your data for research purposes. Information about how to object can be found under ‘Objection to the use of data for research purposes’.
The GGD may only use your personal data if there is a valid reason for doing so. The law specifies a number of reasons, which we explain below:
What laws is this based on?
Sometimes, the GGD will need to share your data with other organisations. It needs to do this for the proper execution of its task. These organisations assist the GGD and work on its instructions. We call these organisations ‘processors’. They may only use your data for the work assigned to them by the GGD. Examples of these organisations are:
Sometimes, the GGD may also share your data with other organisations, such as:
If the GGD shares your data with other organisations, clear agreements are made. These agreements are set out on paper and ensure that your data are processed securely.
The GGD does not share your data (with organisations) outside the European Union (EU).
The GGD shares data about your coronavirus jab with research institutes, such as RIVM. These data are anonymous, which means that researchers cannot identify the individuals to whom the data relate.
Do you not want your data to be used for research purposes?
If you do not want this, you can object to it. Information about how to do so can be found below under ‘Objection to the use of data for research purposes’.
The GGD will retain your data about the coronavirus vaccination for 20 years. It is required to do so under the Medical Treatment Contracts Act. After those 20 years, the data will be destroyed or anonymised. In some cases, the GGD will retain your data for longer. It may only do so:
Your data are stored in a special IT system of the GGD. This system is called CoronIT. Only authorised staff members are able to view your data.
You have a number of rights when it comes to the use of your data:
If you have given your consent for your data to be shared with RIVM, you can have the data removed from the RIVM system at any time. You can do this via the client portal at mijn.rivm.nl/vaccinaties. You will need your DigiD to do this.
You can submit a request to the GGD that administered your coronavirus vaccination. Each GGD has its own privacy statement, which explains how to submit such a request. You can find the relevant privacy statement at www.ggd.nl.
If you do not want your data to be used for scientific and statistical research, you can fill in an objection form. You can do this via the following link: objection form.
You may object at any time. This applies to:
The GGD will need approximately four weeks to process your objection. After processing, your data will no longer be used for research purposes. You will receive confirmation once you have submitted the form.
The GGD does not make decisions about you that are made entirely by an automated system.
This means that a human being is always involved in the decision-making process.
The GGD is obliged by law to ensure that your data are secure. The administrator of the registration system, GGD GHOR Nederland, is NEN7510 certified, which means that it complies with the obligations for data security. The GGD ensures that your data are secure in the following ways, among others:
You can find more information about the security measures in the privacy statement of the regional GGD that administered your coronavirus vaccination.
If you have a question or complaint about how the GGD handles your data, please contact the Data Protection Officer (DPO) at your GGD. Each GGD has its own contact details in the privacy statement at www.ggd.nl.
If you are not satisfied with how your complaint has been handled, you can submit a complaint to the Dutch Data Protection Authority. You can do this via the following website: autoriteitpersoonsgegevens.nl/nl/voordat–u–een–klacht–indient.
You can also send a confidential report, question or complaint to GGD GHOR Nederland, the organisation that supports the GGD. To do so, please send an email to fg@ggdghor.nl.
We will amend this privacy statement if anything changes, for example if we use other data or if another organisation uses your data. The most recent version of this statement can always be found here.
This privacy statement was last amended in July 2025.