Short answer: as soon as you put personal data into an AI tool, the GDPR applies. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) advises first checking whether you can use AI without personal data. Make clear agreements with your team and with the provider.
This article is general information, not legal advice. It follows the guidance of the Dutch regulator; in other EU countries, check your own data protection authority.
When is it a data breach?
The AP received several reports of data breaches caused by employees putting personal data of customers or patients into an AI chatbot. In one case, an employee at a GP practice entered patients' medical data. In another, an employee at a telecom company put a file with customer addresses into a chatbot.
According to the AP:
- If an employee uses a chatbot against company agreements and enters personal data, that is a data breach.
- If the use is company policy, it is not a data breach, but according to the AP it is often not legally allowed either.
- Most companies behind chatbots store everything you enter.
- If things go wrong, reporting to the AP and to the people affected is required in many cases. You report a data breach to the AP within 72 hours of discovering it.
What does the AP advise?
- Make agreements with your staff: may AI be used, and if so, which data may and may not go in?
- Arrange with the provider that entered data is not stored.
- See whether it can be done without personal data. That is the first piece of advice in the AP's tool.
- Get the basics in order before giving AI access to your files: a record of processing activities, an overview of which personal data sits where, and access rights per role. An AI system should not see more than the employee using it.
- Make agreements with the parties involved. If an AI provider processes personal data on your behalf, it is a processor under the GDPR and you need a data processing agreement (Article 28 GDPR).
- Do a DPIA where needed. The AP's tool does not replace a data protection impact assessment (DPIA). You may still need one, and the processing has to go in your record of processing activities.
The AP's tool
The AP has made a free tool, Hulpmiddel inzet generatieve AI & de AVG (in Dutch). You work through statements step by step, from getting the basics in order to choosing a system and using it. It is meant for organisations that use AI, not for companies that build models. It does not cover the AI Act; for that, see The EU AI Act in brief.
Sources
- Autoriteit Persoonsgegevens: Let op, gebruik AI-chatbot kan leiden tot datalekken (6 August 2024, Dutch)
- Autoriteit Persoonsgegevens: Hulpmiddel inzet generatieve AI & de AVG (PDF, Dutch)
- Autoriteit Persoonsgegevens: Datalek voorkomen en voorbereid zijn (Dutch)
- EUR-Lex: General Data Protection Regulation (GDPR), incl. Articles 28 and 33
Accessed 21 October 2026.