Public sector & education
Municipal data backup, stored in the Netherlands and Germany
Mindtime copies your council's mail, files, servers and laptops to immutable storage in its own Tier III data centres in the Netherlands and Germany, keeps an air-gapped copy and checks every backup job.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Municipalities need independent, restorable backups because the Archiefwet, the Woo and the Cyberbeveiligingswet all assume a council can still produce its records after an incident. Since 15 August 2026 every Dutch municipality counts as an essential entity under the Cbw. Mindtime keeps immutable, air-gapped backups of mail, files, servers and laptops in its own Dutch and German data centres.
What's at stake
The data municipalities can't afford to lose
Case files and council decisions
Permits, objections, social-domain files and council decisions live in case-management systems and the document stores around them. Many of these records have to stay retrievable for years, and some are kept permanently under the archive rules.
Mailboxes of key officials
Under the VNG selection list for e-mail, the mailboxes of the mayor, aldermen, municipal secretary and other key officials are kept permanently. A lost or wiped mailbox is a gap in the public record, not just an IT problem.
Citizen and social-domain data
Councils hold some of the most sensitive personal data in the country: income support, youth care and care-at-home files. If that data is lost or leaked, the GDPR notification clock starts and residents rightly expect answers.
Rules and obligations
What the rules ask of municipalities
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Cyberbeveiligingswet: municipalities are essential entities
Article 8 of the Cyberbeveiligingswet, the Dutch law implementing NIS2, names provinces, municipalities and water boards as essential entities, without a size threshold. The law has applied since 15 August 2026. [1]
Continuity duty and staged incident reporting
Under the Cbw, organisations must take appropriate measures to keep their services running; for government bodies this follows BIO2. Significant incidents are reported to the NCSC in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month. [3]
BIO2 as the security baseline
The renewed Baseline Informatiebeveiliging Overheid (BIO2) was adopted on 23 September 2025. For municipalities it is a guiding framework, and it is being built into the obligations that follow from the Cyberbeveiligingswet. [5]
New Archiefwet from 1 January 2027
The new Archiefwet applies to the whole government, municipalities included, from 1 January 2027. Records selected for permanent keeping move to the archive after 10 years instead of 20, and digital information must be managed properly from the moment it is created. [6]
Fixed retention periods for e-mail
The VNG selection list for municipal e-mail (in force since 1 January 2024) keeps mail of key officials permanently, mail of other staff for 7 years and mail from shared functional mailboxes for 1 year after sending or receipt. [7]
When it goes wrong
Ransomware in the document store
Illustrative example: a mid-sized municipality is hit by ransomware on a Friday evening, and the file servers behind its case-management system are encrypted. The attackers also try to delete every backup they can reach from the council network, but Mindtime's copies are immutable and one copy is air-gapped, so they stay intact. Once the IBD and the council's own team have cleaned up the environment, the IT team restores servers and shared files in an isolated recovery environment, has them scanned for malware and brings them back in order of priority. The incident report can then state exactly which data was restored, and from which point in time.
How Mindtime protects it
Backup for municipalities, workload by workload
- Microsoft 365 backupMost councils run mail and shared documents in Microsoft 365, and the e-mail selection list makes those mailboxes part of the archive.
- Google Workspace backupCouncils and joint arrangements using Gmail and Drive need a copy outside Google's own time-limited recovery options.
- VMware and Hyper-V backupCase-management systems and document stores often still run on virtual servers in the council's own data centre.
- Database backupApplications for civil affairs, taxes and finance keep their data in SQL Server or Oracle databases that need consistent backups.
- Disaster RecoveryStandby infrastructure with quarterly DR tests helps a council keep public services running when its own data centre is unavailable.
- NIS2 ComplianceAs essential entities under the Cbw, municipalities have to show how they protect service continuity, and backup is one part of that.
The software you use, and what we protect around it
| Centric (civil affairs, taxes, social domain) | If a Centric application runs on servers in your own data centre, Mindtime backs up those virtual machines and databases. For hosted Centric services, check the export and retention terms in your contract. |
|---|---|
| PinkRoccade Local Government (iBurgerzaken, iFinanciën) | PinkRoccade also delivers its software from its own cloud. For those modules, check the supplier's export and retention terms; Mindtime protects the Microsoft 365 or Google Workspace data, file servers and laptops around them. |
| iBabs (council meetings and decision documents) | iBabs is a SaaS platform, so ask about its export options. Keep the source documents for council papers in a file store or SharePoint site that Mindtime backs up. |
| Microsoft 365 (Exchange Online, OneDrive, SharePoint) | Mindtime backs up Microsoft 365 mail and files to its own data centres in the Netherlands and Germany, including the mailboxes your selection list says to keep. |
| Google Workspace (Gmail, Drive, shared drives) | For councils and joint arrangements that work in Google Workspace, Mindtime keeps an independent backup in NL and DE. You can try it free for 7 days. |
| Virtual servers on VMware or Hyper-V | File servers, document stores and application servers running on VMware or Hyper-V are backed up as complete virtual machines, with every backup job checked. |
Google Workspace
Google Workspace backup for local councils
Some councils, joint arrangements and municipal agencies run their mail and documents in Gmail, Google Drive and shared drives, often next to a separate case-management system. Google's own recovery options are limited in time, so relying on them alone can cost you records the archive rules expect you to keep.
- Drive's trash is not a safety net: files moved to the trash are deleted forever after 30 days, and an administrator can recover items from Drive only within 25 days after a user empties their trash.
- Google Vault is a retention and eDiscovery tool. Google itself states that 'Vault isn't a data archive', and deleting a user or a required licence can purge that user's data for good.
- The Dutch government had Google Workspace Enterprise reviewed in a DPIA and later verification reports, which list measures for public bodies. Those cover privacy settings; whether you can restore deleted or encrypted data is a separate question.
- Mindtime backs up Google Workspace to its own Tier III data centres in the Netherlands and Germany, with immutable storage and an air-gapped copy. Try it free for 7 days.
Before you switch
What municipalities ask us first
Our software suppliers already make backups. Why add another?
A supplier's backup covers its own platform, on its own terms, and is rarely something you can restore from yourself. Your mailboxes, shared drives, file servers and laptops usually remain your responsibility. Mindtime adds an independent, immutable copy in its own Tier III data centres in the Netherlands and Germany, with a data processing agreement in every contract.
Does our citizens' data leave the Netherlands?
Mindtime stores backups only in its own Tier III data centres in the Netherlands and Germany, so the data stays within the EU. Data is encrypted in transit with AES-256, and admin actions require MFA. Mindtime is ISO 27001 audited, and you get a data processing agreement with your contract.
We already account for security every year through ENSIA. Is this extra work?
Mostly it saves work. Mindtime checks every backup job and monitors around the clock, so your CISO has a record of what was protected and when. Disaster recovery customers also get quarterly DR tests, which gives the annual accountability round something concrete to point to.
FAQ
Questions about backup for municipalities
Does the Cyberbeveiligingswet apply to small municipalities too?
Yes. The Cbw names municipalities, provinces and water boards as essential entities regardless of their size, and it has applied since 15 August 2026. For municipalities and provinces, supervision lies with the Rijksinspectie Digitale Infrastructuur (RDI), which points to BIO2 as the starting point for meeting the law. Mindtime helps with the backup part: immutable, checked copies held off-site.
How long must a municipality keep e-mail?
It depends on who sent it. The VNG selection list for e-mail keeps mailboxes of key officials, such as the mayor, aldermen and municipal secretary, permanently. Mail of other staff may be destroyed after 7 years and shared functional mailboxes after 1 year. A backup isn't an archive, but it does make sure a deleted or encrypted mailbox can be put back before those periods run out.
What does the Wet open overheid have to do with backups?
Article 2.4 of the Woo requires every administrative body to keep the documents it receives or creates in good, ordered and accessible condition. Article 4.4 sets a standard decision period of four weeks for an information request. If a file server or mailbox is lost, those documents can't be found or released, so a restorable backup supports the information management the Woo assumes.
Who helps a municipality during a cyber incident?
The Informatiebeveiligingsdienst (IBD) is the sector CERT for all Dutch municipalities and part of the VNG; it offers incident response and advice. Mindtime's role is narrower: making sure clean data is available to restore. Recovery runs in an isolated environment and backups are scanned for malware, with support in Dutch, German or English from people, not chatbots.
Can a shared service organisation manage backups for several councils?
Yes. The Cbw also covers joint arrangements under the Wet gemeenschappelijke regelingen that meet its criteria for public bodies. A shared service centre or IT partner can use Mindtime's multi-tenant console to manage each council as a separate tenant, with REST APIs and hooks for its own tooling and pay-as-you-grow billing.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.