Bookkeeping firms and freelance bookkeepers
PrivaSearch is software that lets your team search its own client files with Claude, ChatGPT or Mistral Vibe, after names, BSNs (Dutch citizen service numbers) and addresses have been replaced by pseudonyms and a colleague has checked that. For a bookkeeping or administration firm, that means: searching bank statements, VAT returns and payslips, while the AI knows no client by name.
An income tax return contains a BSN (Dutch citizen service number), an income and often a partner's details. In a chatbot, all of that goes along.
PrivaSearch replaces that data with pseudonyms. A colleague only releases the document after a review.
The retention obligation of seven years stays in place; PrivaSearch neither extends nor shortens it.
What you use AI for
A bookkeeping firm works for dozens or hundreds of small business owners at once. Every month or quarter, the same kinds of documents come in: statements, receipts, payroll data and emails with questions.
Finding how an expense was booked before and which VAT was declared in a previous quarter, with the passage.
Searching payslips, payroll records and changes, with BSNs, salaries and IBANs replaced by pseudonyms.
Searching the documents of a return for a client or a freelancer for a deduction, a provisional assessment or a question from the Dutch Tax Administration.
Making bank statements and receipts findable per client, with account numbers and the names of counterparties replaced by pseudonyms.
A client asks whether something is deductible or when the return is due. You search their own file for what was declared or agreed before.
Are you an accountant who compiles annual accounts? See the page for accountants.
Which rules apply
The GDPR applies to every firm. A bookkeeping firm also keeps the records of others, with the retention obligation and the BSN that come with them.
The question we hear most often
No tool does that for a firm, PrivaSearch included. The GDPR and the AI Act place the obligations with you as the controller. What your firm arranges itself, and what PrivaSearch does to help:
PrivaSearch is designed for the GDPR. The assessment of your situation remains yours and that of your data protection officer or lawyer.
How it works
The AI only receives text that a colleague has released, with pseudonyms instead of names. See how it works.
The difference
| Topic | WithoutUploading a client file to a chatbot | WithPrivaSearch between your client file and your assistant |
|---|---|---|
| What the AI sees | The entire client file, with names, BSNs and addresses. | Released passages with pseudonyms. |
| Check beforehand | None. | A mandatory review by a colleague. |
| Who may see it | Whoever uploads it, outside any arrangement for the client file. | Only the members of the project. |
| What is recorded | Nothing. | Every view, search and release in the activity log. |
| Where the originals are | With the provider of the chatbot. | In data centres in the EU. |
What you type into the assistant yourself goes straight to it, outside PrivaSearch. So ask about the role or the pseudonym, not about the person.
Frequently asked questions
No tool does that for you. Your firm arranges a lawful basis, a data processing agreement, a DPIA where one is required, an AI policy, AI literacy and professional secrecy itself. PrivaSearch does the technology: pseudonymising before the AI, a mandatory review, permissions per project, the activity log, storage in the EU and a starter document for your AI policy and your DPIA.
Not just like that. It contains a BSN, amounts and names, and the entire file goes to the provider. On a personal account there is no data processing agreement. With PrivaSearch, the assistant only sees released passages with pseudonyms.
PrivaSearch detects a BSN with the eleven test and replaces it with a pseudonym, as it does with an IBAN and a KvK number (Dutch Chamber of Commerce number). In the review, a colleague checks whether everything was found and adds what the model missed.
If that client's documents are in PrivaSearch, you ask your assistant what was declared or agreed before, and you get the passage with its source. What you type into the assistant yourself goes straight to it: ask about the pseudonym, not the client's name.
Not always. A DPIA is required when processing is likely to result in a high risk, for example with payroll for many employers or with sickness absence data. PrivaSearch creates a DPIA starter document based on your own set-up; have it reviewed by a lawyer or your data protection officer.
As long as you set per project. After the end date, PrivaSearch removes originals, passages and pseudonyms. You arrange the seven years of the tax retention obligation in your own records; it always takes precedence.
Sources
The legislation and the pages of the supervisory authority were consulted on 4 November 2026. If you see something that is no longer correct, email us at privacy@privasearch.ai.
Updated on
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →