Rules
What the GDPR is, who it applies to, its principles, lawful bases, rights and duties, the fines involved and what using AI adds to those requirements.
The GDPR is the General Data Protection Regulation, the EU legislation governing what organisations may do with personal data. GDPR legislation applies throughout the European Union and determines when you may collect, use and retain people's data, which rights those people have and what you must document and secure.
Its official name is Regulation (EU) 2016/679 of 27 April 2016; its English abbreviation is GDPR. Searches for “GDPR law” or “privacy law” usually mean the regulation together with the Dutch GDPR Implementation Act that supplements it. The text of the GDPR contains 99 articles. This article covers the parts an organisation needs in practice. It is an explanation, not legal advice: assessing your situation requires your data protection officer or a lawyer.
Under Article 99, the GDPR has applied since 25 May 2018. A regulation applies directly: it does not first need to be transposed into the law of the Netherlands. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, summarises who it applies to on its page the GDPR in brief: everyone who processes personal data.
Article 2 excludes several situations. The best-known is processing by a natural person during a purely personal or household activity, such as an address book. A separate framework applies to police and judicial authorities for investigation and prosecution.
The controller determines why and how data is processed. The processor does so on its behalf, such as a payroll processor or software supplier. Most duties rest on the controller: outsourcing something does not remove your responsibility.
Two definitions in Article 4 determine the scope of the law.
Personal data is any information about an identified or identifiable natural person. This is broader than a name and address: someone can also be identified by a client number, an IP address or a combination of characteristics. The AP gives examples on its page what is personal data, including camera footage in which someone can be recognised. According to the AP, data about organisations and deceased people is excluded, unless it also says something about a living person.
Processing is almost anything you can do with that data: collecting, storing, consulting, using, forwarding or erasing it. Simply retaining it is processing too. So is pasting text into an online service: you disclose the data to another party.
Data concerning matters such as health, ethnic origin and religion is subject to a prohibition with exceptions (Article 9). Criminal offence data and the Dutch citizen service number (BSN) have their own rules. See Special category data: what is it, and may AI process it?.
Article 5 contains the core of the law: six principles.
Above these sits Article 5(2): the controller is responsible for compliance and can demonstrate it. This is accountability: you must be able to show what you do. On its page about accountability, the AP lists the record of processing activities and the data breach register among the mandatory measures.
Only when you have a lawful basis. Article 6 lists six. The AP explains them on its page GDPR lawful bases explained: you determine the lawful basis before you start.
Consent seems the safest choice but is often the weakest. The GDPR's recitals say consent is not a valid basis where there is a clear imbalance between the organisation and the data subject. Can an employee freely refuse when their employer asks? And someone withdrawing consent leaves you without a lawful basis. A contract often fits client administration better, and a legal obligation fits payroll administration.
Five of the six lawful bases contain the word necessary. It means more than convenient: can you achieve the purpose in a less intrusive way? This question returns with every new tool, including AI.
Articles 12 to 22 give the people the data concerns, the data subjects, a series of rights.
You respond to a request without undue delay and in any event within one month. That period may be extended by two months where necessary if you notify the person within the first month (Article 12(3)). Anyone dissatisfied may lodge a complaint with the supervisory authority (Article 77) and is entitled to compensation where damage occurs (Article 82).
The principles are general; the duties are specific. The table compares the main ones. Not every duty applies to every organisation.
| Duty | Article | What you actually do |
|---|---|---|
| A lawful basis for each processing activity | Art. 6 | Record the lawful basis for each purpose before you start |
| Informing people | Arts. 13 and 14 | A privacy statement matching what you actually do |
| Record of processing activities | Art. 30 | Document purpose, categories of data and data subjects, recipients, transfers, retention period and security for each processing activity |
| Data processing agreement | Art. 28 | Enter into an agreement with every party processing data on your behalf |
| Security | Art. 32 | Measures appropriate to the risk, such as access management, encryption and pseudonymisation |
| Reporting and documenting data breaches | Arts. 33 and 34 | A procedure, a risk assessment for each incident and a data breach register |
| Data protection impact assessment (DPIA) | Arts. 35 and 36 | Describe risks and measures before processing likely to present a high risk |
| Data protection officer (DPO) | Art. 37 | Check whether you must appoint one and substantiate that choice |
| Transfers outside the EEA | Art. 44 onwards | Record the basis for the transfer for each recipient outside the EEA |
Article 30(5) provides an exception for organisations with fewer than 250 employees. It ceases to apply if processing is likely to present a risk, is not occasional or concerns special category or criminal offence data. Payroll administration is not occasional, so in practice almost every organisation needs a record. See Record of processing activities: what to include, with an example for AI tools.
A DPIA is mandatory if processing, especially with new technology, is likely to present a high risk, for example large-scale processing of special category or criminal offence data. The AP also has its own list of processing activities requiring a DPIA, on its page about the data protection impact assessment. How to conduct one is explained in DPIA for AI tools.
Article 37 requires three groups to appoint a DPO: public authorities, organisations whose core activities involve regular and systematic monitoring of people on a large scale, and organisations whose core activities involve large-scale processing of special category or criminal offence data. According to the AP, if in doubt you must be able to substantiate why you do or do not have a DPO.
You report a data breach to the AP unless a risk to data subjects is unlikely, and within 72 hours where possible. The details are in What is a data breach? Examples, reporting duties and what to do within 72 hours.
In the Netherlands, the Autoriteit Persoonsgegevens is the supervisory authority. It may issue a reprimand, impose a processing ban or an order subject to a periodic penalty payment, and levy a fine. Its page fines and other sanctions provides an overview.
Article 83 sets two ceilings.
For an undertaking, the percentage applies if it is higher. These are maximum amounts: the fine in an actual case depends on factors including severity, duration and intent or negligence. One example of what the AP imposes in practice: in December 2025, a university of applied sciences received a €175,000 fine for inadequate security of personal data.
The GDPR gives member states discretion on several points. The Netherlands has exercised it in the Dutch GDPR Implementation Act, which replaced the Dutch Personal Data Protection Act. Anyone seeking to understand Dutch GDPR legislation therefore reads both.
Nothing in the text of the law. The AP says on its page algorithms, AI and the GDPR that the GDPR was drafted to be technology-neutral: how processing is technically performed makes no difference to supervision. What changes is how often, and how unnoticed, existing rules are engaged.
Anyone pasting a client's email into an AI chatbot discloses personal data to another party. That needs a lawful basis and a purpose compatible with why the client provided their data. This is explained by data type in client data in an AI chatbot: the rules for each type of data.
A chat window encourages uploading the whole document for one question. The principle of data minimisation calls for the opposite. A tenant's name and BSN are rarely necessary for a question about a notice period.
A consumer subscription generally has no data processing agreement; the large providers do offer one on business subscriptions. This varies by subscription and changes regularly (as of October 2026): check the terms yourself. See which subscription may you use for business.
The AP says you establish beforehand whether you can meet the GDPR's requirements, even for a pilot, and conduct a DPIA for algorithmic systems involving personal data. This includes an entry in the record of processing activities and, for a provider outside the EEA, a basis for the transfer.
Article 22 protects people against decisions made solely by automated means that significantly affect them, such as an automatic rejection. Anyone using AI for selection or assessment encounters this, and also the EU AI Act: a separate European regulation alongside the GDPR. See The AI Act explained.
If things go wrong, the reporting duty applies. In 2024 the AP said it had received data breach notifications after employees shared personal data with an AI chatbot.
PrivaSearch addresses one part: AI on documents containing personal data. Personal data is detected and replaced with pseudonyms within PrivaSearch, and a colleague approves before a document becomes searchable. The steps are on how PrivaSearch works.
You can search within PrivaSearch or through a connected AI assistant: Claude, ChatGPT Business or Mistral Vibe (formerly Le Chat). The assistant receives only released, pseudonymised passages. This fits the principle of data minimisation; see ChatGPT, Claude, Mistral Vibe and the GDPR.
Your environment creates starter documents: an AI policy, a DPIA starter document, the entry for the record of processing activities and the written lawful basis. It is not legal advice. More is on GDPR and EU AI Act.
The GDPR itself remains your responsibility. Pseudonymised data remains personal data for your organisation, automatic detection is never complete, and anything an employee types into an assistant goes directly to its provider. To see how it works, book a demo.
The GDPR is the European privacy legislation that has governed what organisations may do with personal data since 25 May 2018. You need a lawful basis and purpose for every processing activity, use no more data than necessary, secure it and do not keep it too long. People have rights, such as access and erasure.
GDPR legislation applies to everyone processing personal data: businesses of every size, government, associations and foundations, and also organisations outside the EU targeting people in the EU. Only processing for purely personal or household use, such as an address book, is excluded.
There is no difference in the regulation. GDPR stands for General Data Protection Regulation, the English name of the same European regulation whose Dutch title is Algemene verordening gegevensbescherming. Each country does, however, have its own supplementary rules. In the Netherlands these are in the Dutch GDPR Implementation Act, for example concerning the BSN.
The law has two maximum amounts. For breaches of duties such as the record, security and data breach reporting, it is €10 million or 2% of worldwide annual turnover. For breaches of principles, lawful bases and people's rights, it is €20 million or 4%. The actual amount depends on the case.
No. Consent is one of six lawful bases. Another often fits better: performing a contract for client administration, a legal obligation for payroll administration, or legitimate interests where you balance your interest against the data subject's. For special category data, such as health data, you need a statutory exception as well as a lawful basis.
Yes. The GDPR is technology-neutral and applies to all processing of personal data, including entering an email or client file into an AI chatbot. You need a lawful basis, an appropriate purpose, agreements with the provider and an entry in your record of processing activities. Do not share more than necessary.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →