I think you have a misunderstanding of what DigiD is. It is not "a digital central database", it does not store your personal information. It only serves as an authentication mechanism. When you logon on some site that uses DigiD, you get redirected to a DigiD logon which can use whatever method to identify you, and then passes back information about your identity (your BSN) to the site where you logged on. So that site can be sure that you are who you claim to be. (within the limitations of the chosen authentication method, which can be as simple as username/password which does not provide much guarantee, but it can also include 2nd factor and more) When DigiD would be hacked, it would be possible to access sites that use it under someone else's identity. But as long as it is not hacked, there still is no guarantee of the security of your personal information, as shown in the GGD case, because there can be other paths to the information that do not involve a DigiD login (in this case: access by ...