8 April 2026 • Cyber security
For healthcare organisations in the Netherlands, the question of whether NEN 7510 is legally required comes up often. The standard itself is not a law, but through legislation and regulatory oversight, NEN 7510 is mandatory for virtually every organisation that handles medical personal data. This article explains what that means, who it applies to, and why security awareness training is an inseparable part of compliance.
What is NEN 7510?
NEN 7510 is the Dutch standard for information security in healthcare. It is based on ISO 27001 and ISO 27002, but specifically tailored to the healthcare sector. It describes how healthcare organisations must protect patient data: from access control and encryption to policies, audits, and employee training.
Is NEN 7510 legally required?
NEN 7510 is not a law in itself, but it is legally required in practice. The standard is explicitly referenced in the Dutch Act on Additional Provisions for the Processing of Personal Data in Healthcare (Wabvpz) and forms part of the assessment framework used by the Dutch Healthcare and Youth Inspectorate (IGJ). Organisations connecting to the National Switch Point (LSP) must demonstrably comply with NEN 7510.
In short: NEN 7510 is mandatory for all healthcare organisations that exchange medical data electronically. Failing to comply risks not only a formal notice from the IGJ, but also serious reputational damage in the event of a data breach.
Who does NEN 7510 apply to?
The standard applies to healthcare organisations that process health-related personal data. This includes:
- Hospitals and clinics
- General practitioner practices
- Mental health institutions
- Pharmacists
- Home care organisations
- Healthcare software vendors (as processors)
In practice, IT suppliers supporting healthcare organisations also fall within the scope of the standard.
Why NEN 7510 and security awareness training go hand in hand
A large share of security incidents in healthcare does not stem from technical vulnerabilities, but from human behaviour. An employee who clicks a phishing link, shares a password, or leaves a screen unattended can cause more damage than most technical exploits.
NEN 7510 recognises this. The standard requires that employees receive demonstrable information security training, tailored to their role. One-off awareness sessions are not enough: training must be repeated regularly and results must be documented for audits.
That is exactly why NEN 7510 and security awareness training are inseparable. Technical measures protect the systems. Aware employees protect the organisation.
How to meet the NEN 7510 training requirements
Meeting the NEN 7510 training requirements demands more than an annual e-learning module. Effective training works continuously, is measurable, and fits the daily reality of healthcare staff.
Guardey offers NEN 7510 training that aligns with the requirements of the standard: weekly microtrainings, phishing simulations, and audit-ready reports for the IGJ or an external auditor.
Does your organisation meet the NEN 7510 training requirements?
Guardey helps healthcare organisations comply with NEN 7510 through weekly microtrainings, phishing simulations, and audit-ready reporting. Request a demo and see how it works for your team.
