PrivaSearch

Protective administration and debt counselling

AI in protective administration and debt counselling, within the GDPR. For people who rely on your care.

PrivaSearch is software that lets your team search its own client files with Claude, ChatGPT or Mistral Vibe, after names, BSNs (Dutch citizen service numbers) and addresses have been replaced by pseudonyms and a colleague has checked that. For a protective administrator or debt counsellor, that means: querying income, debt and care files, while the AI does not know who the person concerned is.

In short

An administration file contains the income, debts and often the health of someone who needs extra protection.

PrivaSearch replaces names, BSNs (Dutch citizen service numbers) and IBANs with pseudonyms and has a colleague release every document.

Only whoever manages the file of a person concerned sees it. The activity log records who viewed what.

What you use AI for

The client files that matter.

A protective administrator or debt counsellor manages a file per person concerned, full of letters, agreements and statements. Finding things quickly helps, but the people behind those files are vulnerable.

  1. The file per person concerned

    Finding which fixed costs, benefits and agreements are running, with the data of the person concerned replaced by pseudonyms.

  2. Debt overviews

    Searching letters from creditors and payment arrangements for an amount, a deadline or an earlier agreement.

  3. Annual account and report

    Gathering the documents for the yearly account to the subdistrict court more quickly.

  4. Debt counselling commissioned by the municipality

    Querying intakes and plans of action, with a review before anything becomes searchable.

Which rules apply

What the law asks of your client files.

Protective administration and debt counselling each have a legal basis of their own. Both concern people who deserve extra protection, and that counts in your assessment.

The question we hear most often

Working GDPR-proof with AI in protective administration: what does that involve?

No tool does that for a firm, PrivaSearch included. The GDPR and the AI Act place the obligations with you as the controller. What your firm arranges itself, and what PrivaSearch does to help:

What your firm arranges itself

  • A lawful basis (Articles 6 and 9 GDPR)A lawful basis for every processing operation, and for special category data an exception from Article 9(2) as well.
  • A data processing agreement (Article 28 GDPR)With every party that processes data for you: with PrivaSearch, and with the provider of the AI assistant you connect.
  • A DPIA where one is required (Article 35 GDPR)Often with special category data or processing on a large scale.
  • An AI policyWhich tools are allowed, with which data, and who decides on that.
  • AI literacy (Article 4 AI Act)Staff who work with AI know what they are doing and what the risks are.
  • Professional secrecyConfidentiality towards the person concerned, who often depends on you. Per project, appoint only reviewers who may already view the file.

What PrivaSearch does to help

  • Pseudonymising before the AINames, BSNs (Dutch citizen service numbers) and addresses are replaced before anything goes to your AI assistant.
  • A mandatory privacy reviewA colleague checks and approves every document. Only then is it searchable.
  • Permissions per projectOnly the members of a project see the documents of that project.
  • The activity logWho viewed, searched, released or revealed what, without document content in the log.
  • Storage in the EUOriginals are stored in data centres in the EU, in a database of its own per organisation.
  • An AI policy and a DPIA to start withStarter documents based on your own set-up, to have reviewed.

PrivaSearch is designed for the GDPR. The assessment of your situation remains yours and that of your data protection officer or lawyer.

How it works

From client file to answer, in four steps.

The AI only receives text that a colleague has released, with pseudonyms instead of names. See how it works.

  1. Add client files. Upload documents or connect a SharePoint library; SharePoint is only read.
  2. Detect and pseudonymise. A language model within PrivaSearch and Dutch patterns (BSN with the eleven test, IBAN, Dutch number plate, KvK number) find personal data and replace it with pseudonyms.
  3. A colleague reviews. Original and pseudonym are side by side. What the model missed, the reviewer adds; then they approve the document.
  4. Search with your assistant. Claude, ChatGPT Business or Mistral Vibe searches the released passages through a secure MCP connection, for example: “Which payment arrangement was agreed in 2026 with the creditors of [PERSOON_B4A1]?”

The difference

A client file in a chatbot, or through PrivaSearch.

Topic WithoutUploading a client file to a chatbot WithPrivaSearch between your client file and your assistant
What the AI sees The entire client file, with names, BSNs and addresses. Released passages with pseudonyms.
Check beforehand None. A mandatory review by a colleague.
Who may see it Whoever uploads it, outside any arrangement for the client file. Only the members of the project.
What is recorded Nothing. Every view, search and release in the activity log.
Where the originals are With the provider of the chatbot. In data centres in the EU.

What you type into the assistant yourself goes straight to it, outside PrivaSearch. So ask about the role or the pseudonym, not about the person.

Frequently asked questions

What you probably want to know.

Working GDPR-proof with AI in protective administration: what does that involve?

No tool does that for you. Your firm arranges a lawful basis, a data processing agreement, a DPIA where one is required, an AI policy, AI literacy and professional secrecy itself. PrivaSearch does the technology: pseudonymising before the AI, a mandatory review, permissions per project, the activity log, storage in the EU and a starter document for your AI policy and your DPIA.

May a protective administrator put client files into an AI chatbot?

The entire file then goes to the provider, with income, debts and often health. The people it concerns can usually not have a say in that themselves. With PrivaSearch, the assistant only sees released passages with pseudonyms.

Is a DPIA needed for administration or debt counselling files?

The chance is high. Vulnerable data subjects and health data weigh heavily in the question of whether a DPIA is required. PrivaSearch creates a DPIA starter document that takes vulnerable data subjects into account; have it reviewed by a lawyer or your data protection officer.

Can the person concerned look in PrivaSearch themselves?

No. PrivaSearch is for the staff of your organisation, with permissions per project. You handle an access request from a person concerned as you do now; the activity log shows who has viewed the file.

Can we create a separate project per person concerned?

Yes. A project has its own members and its own retention period. After the end date, PrivaSearch removes the originals, passages and pseudonyms of that project.

Does PrivaSearch make decisions about a person concerned?

No. PrivaSearch helps you find what is already in the file. The AI policy that PrivaSearch drafts prohibits using AI output as the basis for a decision about a person without your own substantive assessment.

Updated on

See in twenty minutes what happens to your documents.

We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.

Book a demo →