U.S., UK, and European municipalities are increasingly experimenting with data as an instrument for social policy. This movement pertains often to the design of municipal data warehouses, dashboards, and predictive analytics, the latter mostly to identify risk of fraud. This transition to data-driven social policy, captured by the term “digital welfare state,” almost completely takes place out of political and social view, and escapes democratic decision making. In this article, I zoom in on The Netherlands and show in detail how sound data governance is lacking at three levels: data experiments and practices take place in a so-called “institutional void” without any clear democratic mandate; moreover, they are often based on disputable quality of data and analytic models; and they tend to transgress the recent EU General Data Protection Regulation (GDPR) about privacy and data protection. I also assess that key stakeholders in this data transition, that is the citizens whose data are used, are not actively informed let alone invited to participate. As a result, a practice of top-down monitoring, containment and control is evolving despite the desire of civil servants in this domain to do “good” with data. I explore several data and policy alternatives in the conclusion to contribute to a higher quality and more democratic usage of data in the digital welfare state.