EUDI Wallet Netherlands: NL-wallet Open Source

Overview

The Netherlands is taking a unique approach to EUDI Wallet implementation: radical transparency through open source development. With a population of 18.0 million, the Netherlands is building NL-wallet entirely in public on GitHub, allowing citizens, security researchers, and privacy advocates to review every line of code, architectural decision, and security measure.

This transparency reflects core Dutch values: accountability, privacy protection, and democratic oversight of government technology. By publishing the source code on GitHub under the MinBZK (Ministry of the Interior) organization, the Netherlands demonstrates that building public trust requires openness—citizens can verify that NL-wallet operates exactly as claimed, with no hidden data collection or backdoors.

Key Information

• App Name: NL-wallet 🟢 (verified)
• Authentication: DigiD (15+ million users) 🟢 (verified)
• Activation Method: DigiD + driving licence or ID card 🟢 (verified)
• Open Source: Yes - GitHub MinBZK/nl-wallet 🟢 (verified)
• Lead Agency: MinBZK (Ministry of the Interior and Kingdom Relations)
• Status: Piloting phase
• Target Launch: December 31, 2026 (eIDAS 2.0 regulatory deadline)
• Population: 18 million
• Privacy Approach: Privacy by design, data minimization, user control
• Data Protection Oversight: Autoriteit Persoonsgegevens (Dutch DPA)

NL-wallet: The Netherlands' Digital Identity Solution

NL-wallet is the Netherlands' implementation of the EUDI Wallet mandated by eIDAS 2.0 regulation. The wallet will enable Dutch citizens to store and share digital credentials securely on their smartphones, starting with government-issued documents like ID cards and driver's licenses, and eventually expanding to private sector credentials like bank accounts, diplomas, and professional licenses.

Design Principles

NL-wallet development follows core Dutch principles:

• Privacy by Design: Credentials stored locally on your device, not in government databases
• Data Minimization: Share only necessary attributes (age, address, nationality)
• User Control: You decide when and where to share identity data
• Transparency: Open source code allows independent verification
• Accessibility: Designed for all citizens, including those with disabilities
• Voluntary Use: Physical documents remain valid alternatives

DigiD: The Netherlands' Universal Authentication

Understanding NL-wallet requires understanding DigiD—the foundation of Dutch digital government.

What is DigiD?

DigiD (Digitale Identiteit) is the Netherlands' universal authentication system for government services. Launched in 2004, DigiD has grown to over 15 million users—representing the vast majority of Dutch adults. If you've filed taxes online, applied for benefits, accessed healthcare records, or used any Dutch government digital service, you've used DigiD.

How DigiD Works

DigiD provides secure authentication through multiple methods:

• Username + Password: Basic login for lower-security services
• SMS Verification: Two-factor authentication with phone number
• DigiD App: Mobile app with biometric authentication (fingerprint/Face ID)
• eIDAS Authentication: European cross-border authentication

DigiD Services

Dutch citizens use DigiD to access:

• Tax Services (Belastingdienst): Income tax filing, tax refunds, payment arrangements
• Social Security (UWV): Unemployment benefits, disability benefits, work history
• Healthcare (DigiD Machtigen): Medical records, prescription access, insurance information
• Education (DUO): Student loans, grants, enrollment verification
• Municipal Services: Address registration, permits, certificates
• Pensions (SVB): State pension, child benefits, elderly care
• Business Services (KVK): Business registration, company data, permits

Why DigiD for NL-wallet Activation?

Using DigiD to activate NL-wallet makes practical sense:

• Existing User Base: 15+ million Dutch people already have DigiD accounts
• Trusted Authentication: DigiD has 20+ years of security hardening and public trust
• No New Enrollment: Citizens don't need to create yet another account
• Government Integration: DigiD already connects to all identity databases
• Multi-Factor Support: DigiD provides strong authentication (password + SMS or biometric)

Activation Process: DigiD + Physical Document

The Netherlands has designed a two-factor activation process combining digital and physical identity verification.

Step-by-Step Activation

1. Download NL-wallet: Install the app from App Store or Google Play
2. DigiD Authentication: Log in with your DigiD credentials (username/password + SMS or DigiD app)
3. Prepare Physical Document: Have your Dutch driving licence or ID card ready
4. Document Verification: Use your smartphone's NFC reader to scan the chip in your driving licence or ID card
5. PIN Entry: Enter the PIN associated with your physical document
6. Cryptographic Verification: NL-wallet reads and verifies the digital certificate stored on the chip
7. Credential Issuance: Government systems issue digital credentials to your NL-wallet
8. Security Setup: Configure app security (biometric authentication or PIN)
9. Activation Complete: Your NL-wallet is now ready to use

Why Physical Document is Required

The two-factor approach (DigiD + physical document) prevents identity fraud:

• DigiD Alone: Confirms you have legitimate DigiD access, but accounts can be compromised
• Physical Document Alone: Proves possession of government-issued ID, but doesn't verify online identity
• Both Together: Ensures the person activating NL-wallet is the legitimate owner of both the DigiD account and the physical identity document

Modern Dutch driving licences and ID cards contain secure chips with cryptographic certificates. The NFC verification process reads these certificates and validates them against government databases, ensuring the document is authentic, not expired, and not reported lost or stolen.

Open Source Development on GitHub

The Netherlands' decision to develop NL-wallet as open source on GitHub is extraordinary for government digital identity systems.

GitHub Repository: MinBZK/nl-wallet

The official repository contains:

• Source Code: Complete mobile app code (iOS and Android)
• Backend Services: Credential issuance, verification, and management systems
• Architecture Documentation: Technical design, security specifications, data flows
• Development Roadmap: Planned features, milestones, release schedules
• Issue Tracking: Bug reports, feature requests, security vulnerabilities
• Contribution Guidelines: How developers and researchers can participate

Benefits of Open Source

Security Through Transparency

Open source allows independent security researchers to audit the code and identify vulnerabilities before launch. Contrast this with closed-source wallets where bugs remain hidden until exploited by attackers. The Netherlands embraces the principle: "Many eyes make bugs shallow."

Privacy Verification

Citizens and privacy advocates can verify that NL-wallet:

• Stores credentials locally on devices (not in government databases)
• Does not collect unnecessary personal data
• Does not track user behavior for profiling
• Implements selective disclosure correctly
• Deletes data when users request it

Public Trust and Accountability

When governments build identity systems in secret, citizens have legitimate concerns about surveillance, data misuse, and function creep (gradual expansion beyond original purpose). Open source code provides accountability—if MinBZK claims NL-wallet protects privacy, anyone can verify that claim by reading the code.

Collaboration with Other Countries

Open source allows other EU countries to learn from the Netherlands' implementation. Smaller member states with limited resources can adapt NL-wallet code instead of building from scratch. This accelerates EU-wide EUDI Wallet deployment and improves interoperability.

Community Contribution

Developers, researchers, and security experts can contribute improvements:

• Report bugs and vulnerabilities
• Suggest security enhancements
• Improve accessibility features
• Translate documentation
• Optimize performance

Open Source License

The NL-wallet repository uses an open source license (typically EUPL - European Union Public License), allowing anyone to:

• View and study the code
• Modify the code for their own purposes
• Distribute modified versions (with attribution)
• Use the code in commercial or non-commercial projects

Ministry of the Interior (MinBZK): Coordination and Leadership

MinBZK (Ministerie van Binnenlandse Zaken en Koninkrijksrelaties) leads NL-wallet development and coordinates the Netherlands' digital identity strategy.

MinBZK's Responsibilities

• Strategic Planning: Define the Netherlands' EUDI Wallet roadmap and compliance strategy
• Technical Development: Manage GitHub repository, coordinate developers, oversee architecture
• Regulatory Compliance: Ensure NL-wallet meets eIDAS 2.0 and GDPR requirements
• Stakeholder Coordination: Align government agencies, municipalities, and private sector
• DigiD Management: Maintain and evolve DigiD authentication infrastructure
• Privacy Protection: Work with Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
• Public Communication: Educate citizens about NL-wallet benefits and usage
• International Collaboration: Participate in EU interoperability testing

Collaboration with Other Government Agencies

NL-wallet requires coordination across Dutch government:

• RDW (Road Transport Agency): Driver's license credentials
• Municipalities: ID cards, birth/marriage certificates, address registration
• Belastingdienst (Tax Authority): Tax identification, income verification
• UWV (Social Security): Employment history, benefits
• DUO (Education Executive Agency): Diplomas, student records
• Ministry of Justice and Security: Legal framework, law enforcement access controls
• Ministry of Health: Health insurance cards, prescription data

Dutch Approach to Privacy and Data Protection

The Netherlands has a strong tradition of privacy protection and skepticism toward government surveillance, shaped by historical experiences and democratic values.

Privacy by Design

NL-wallet implements privacy from the ground up:

• Local Storage: Credentials stored on your device, not in centralized government databases
• Selective Disclosure: Share only necessary attributes (e.g., "over 18" without full birth date)
• Minimal Data Collection: No tracking of when or where you use credentials
• User Consent: Explicit approval required for each data sharing request
• Audit Logs: You can view complete history of credential usage
• Data Deletion: Delete credentials without affecting physical documents

GDPR Compliance

As a government service processing citizen data, NL-wallet must comply with GDPR:

• Data Minimization: Collect and share only necessary personal data
• Purpose Limitation: Identity data used only for authentication, not advertising or profiling
• Transparency: Clear information about data processing
• Right to Access: View all data stored in your wallet
• Right to Deletion: Delete wallet and credentials on request
• Right to Portability: Export your data in machine-readable format
• Privacy Impact Assessments: Regular DPIA reviews before new features

Autoriteit Persoonsgegevens (Dutch DPA) Oversight

The Autoriteit Persoonsgegevens (AP) is the Netherlands' independent Data Protection Authority, responsible for enforcing GDPR and Dutch privacy laws. AP:

• Reviews NL-wallet privacy impact assessments
• Investigates citizen complaints about data processing
• Audits MinBZK compliance with privacy regulations
• Issues recommendations for privacy improvements
• Can impose fines or restrictions if violations are found

Selective Disclosure: Privacy-Preserving Sharing

NL-wallet will support selective disclosure—sharing only the minimum information needed:

Age Verification Examples

• Traditional ID: Show entire ID card (reveals birth date, address, ID number—far more than needed)
• NL-wallet Selective Disclosure: Share only "over 18: yes" without birth date, name, or other data

Residency Verification Examples

• Traditional: Show full address (street, house number, postal code, city)
• NL-wallet Selective Disclosure: Share only "resident of Netherlands: yes" or "resident of Amsterdam: yes"

Nationality Verification Examples

• Traditional: Show passport revealing name, photo, passport number, birth date
• NL-wallet Selective Disclosure: Share only "EU citizen: yes" or "Dutch citizen: yes"

Use Cases: Government Services and Beyond

NL-wallet will enable a wide range of use cases within the Netherlands and across the EU.

Government Services

• Authenticate for online tax filing (replace DigiD login in some scenarios)
• Apply for permits and licenses (building permits, business licenses)
• Access social security services (unemployment, disability, pensions)
• Register address changes with municipality
• Verify identity for notary services (property purchases, wills)
• Prove residency for municipal services (library cards, parking permits)
• Access healthcare records and prescriptions

Financial Services (Mandatory from 2027)

• Open bank accounts (KYC verification required by law)
• Apply for mortgages and loans
• Verify identity for investment accounts
• Cryptocurrency exchange verification
• International money transfers (AML compliance)

Age Verification

• Purchase age-restricted products (alcohol, tobacco)
• Access age-restricted online content (gambling, social media)
• Prove eligibility for youth or senior discounts

Cross-Border Use (Post-2026)

Once NL-wallet achieves full EUDI compliance, Dutch citizens can use it across the EU:

• Rental cars in other EU countries (show digital driver's license)
• Hotel check-ins without surrendering physical passport
• Open bank accounts in other EU countries
• Prove professional qualifications for work abroad
• University enrollment in other EU countries
• Access emergency healthcare with EHIC integration

Private Sector Credentials

Beyond government documents, NL-wallet will support:

• University diplomas and transcripts
• Professional certifications and licenses
• Employment credentials and work history
• Health insurance cards and coverage details
• Loyalty cards and memberships

Timeline and Rollout Strategy

Completed Milestones

• 2004: DigiD launched (foundation for NL-wallet authentication)
• 2010s: DigiD adoption grows to 15+ million users
• April 2024: eIDAS 2.0 regulation signed into EU law
• May 2024: eIDAS 2.0 enters into force
• 2024: MinBZK establishes GitHub repository (MinBZK/nl-wallet)
• 2024-2025: Open source development, architecture definition, security specifications
• November 2024: EU adopts implementing acts for EUDI Wallet technical standards
• 2025-2026: Piloting phase with selected user groups

Planned Milestones

• Q1-Q2 2026: Expanded pilot testing with more participants
• Q3 2026: Cross-border interoperability testing with Germany, Belgium, Luxembourg
• Q4 2026: Security audits, privacy impact assessments, final certification
• December 31, 2026: NL-wallet available to all Dutch citizens (EU regulatory deadline)
• 2027: Gradual rollout and service integration
• End of 2027: Banks required to accept EUDI Wallet for KYC verification
• 2027-2030: Private sector credential integration (diplomas, employment, health)

Regulatory Deadline Compliance: December 2026

Under eIDAS 2.0 regulation (EU 2024/1183), all EU member states must provide at least one EUDI Wallet to citizens by December 31, 2026.

Netherlands' Readiness Assessment

The Netherlands is well-positioned to meet the deadline:

• DigiD Foundation: 15+ million users already have authentication accounts
• NFC-Enabled Documents: Modern Dutch driver's licenses and ID cards have chips
• Open Development: Transparent progress on GitHub allows real-time monitoring
• Technical Expertise: MinBZK has decades of digital government experience
• Piloting Active: Real-world testing already underway

Contingency Planning

If technical challenges arise, the Netherlands has options:

• Phased Launch: Start with basic features, add advanced capabilities later
• Limited Pilot Extension: Launch to pilot users in December 2026, expand to general public in early 2027
• Extension Request: eIDAS 2.0 allows member states to request deadline extensions with justification

Given the transparent development approach, citizens and EU regulators can assess progress directly from the GitHub repository, reducing uncertainty about compliance.

Security Architecture and Technology

NL-wallet employs multiple security layers to protect credentials and user privacy.

Device Security

• Biometric Authentication: Fingerprint or Face ID required to access app
• PIN Fallback: Secure numeric PIN for devices without biometrics
• Secure Element Storage: Cryptographic keys stored in hardware-protected area
• Device Binding: Credentials tied to specific smartphone (cannot be cloned)
• Automatic Lock: App locks after inactivity to prevent unauthorized access

Credential Verification

When you share a credential, verification works as follows:

1. Service requests specific credential or attribute (age, residency, nationality)
2. NL-wallet shows you exactly what data will be shared
3. You approve or deny the request
4. If approved, NL-wallet generates cryptographically signed proof
5. The service verifies the signature against Dutch government public keys
6. The service checks that the credential has not been revoked or expired
7. Verification succeeds or fails based on cryptographic validity

Offline Verification

NL-wallet will support offline credential verification (no internet connection required):

• Credentials contain embedded cryptographic signatures
• Verifiers use locally cached government public keys to check signatures
• QR codes or NFC contain signed credential data
• Revocation lists periodically updated when online

This enables use cases like presenting ID at remote border crossings, rural areas without cellular coverage, or during internet outages.

Comparison with Other Dutch Digital Identity Systems

DigiD vs. NL-wallet

• DigiD: Authentication system for logging into government websites (online only)
• NL-wallet: Credential storage and sharing (online and offline, government and private sector)
• Relationship: DigiD used to activate NL-wallet; both systems complement each other

eIDAS Node vs. NL-wallet

• eIDAS Node: Cross-border authentication gateway (infrastructure for government systems)
• NL-wallet: End-user mobile app for credential storage and sharing
• Relationship: NL-wallet connects to eIDAS infrastructure for cross-border verification

Official Resources and Support

For the latest information about the Netherlands' EUDI Wallet and NL-wallet:

• NL Digital Government - ID Wallet - Official information and updates
• GitHub - MinBZK/nl-wallet - Open source repository (code, architecture, documentation)
• DigiD Official Website - Dutch digital authentication system
• Ministry of the Interior (MinBZK) - Lead agency for NL-wallet