Tech & Digital

Healthtech and EU Privacy: Health Data and Your Dutch Company

Updated: 18 August 2026 Holdwise editorial team Healthtech Privacy Health data

Under EU privacy law, the strictest rules apply to health data. It is special-category data, which needs an explicit legal basis. The care sector has its own security standards, and buyers audit vendors before a pilot starts. Healthtech vendors who prepare their compliance file first sell more easily to Europe's largest care systems. A Dutch company is a good base for this file. At Holdwise, we keep this answer up to date and change it when the rules change.

Health data as special-category data

To process health data, you need an explicit legal basis: consent, medical treatment or a defined public interest. For large-scale processing, you also need an impact assessment. You must also make certain design choices: you collect as little data as possible, you pseudonymise it and you log who has access. The Dutch care sector has its own security standards, the NEN-7510 series, and hospitals score them in procurement. A recognised certificate counts for more than a long written explanation.

Two questions to answer early

Medical device or software: once your product is used to diagnose, monitor or treat patients, the rules for medical devices apply. See medtech in the EU. Secondary use: research and analysis on care data fall under the new rules for the European Health Data Space. Today these rules are a compliance question. As the rules develop, you may also get access to more data. Plan one design session for each of these two questions, before the technical design is finished. At that stage, changes cost the least.

Is your group setting up a Dutch entity? See setting up a Dutch subsidiary for what you need, how long it takes and what the parent company must sign.

The Dutch company and the compliance file

The Dutch BV contracts with hospitals and insurers as the EU counterparty their assessments want. It keeps the certifications at one address. Underneath is the standard setup. WBSO on the development work (the credit). The innovation box on qualifying profit (the 9%). And the residency answer ready (that page). All of it matches inside the standard holding chart: the full structure.

Free advice

Want our team to have a look?

We help entrepreneurs and international companies with their company in the Netherlands and Europe. Tell us where you stand or what you are planning. You get free advice on your next step.

Part of Doing Business in the Netherlands, the complete 2026 guide.

Frequently asked questions

Can we train models on patient data we process? +

Only within the legal basis and the instructions of the controller. You may use hospital data only for the hospital's purposes, unless there is a separate legal basis. Plan the design session on secondary use before the first training round.

Do we need NEN-7510 certification to sell to Dutch hospitals? +

Often yes. Hospitals increasingly require it for any product that handles care data. One certificate counts with many buyers. Include the cost in your budget for entering the market.

When was this last checked? +

Reviewed 18 August 2026. The rules for the European Health Data Space are being introduced in phases. The privacy and security requirements described here are permanent.

Sources Belastingdienst · KVK · wetten.overheid.nl Last updated: 18 August 2026