AI and privacy
What you need to arrange for each type of data before using an AI chatbot: from names and email addresses to health, criminal records and BSNs.
Only if you have made the arrangements first. For ordinary client data, you need a lawful basis, a purpose compatible with why you received the data, a data processing agreement with the provider and a valid basis for transfers outside the EU. Stricter rules apply to health data, criminal offence data and the BSN. A free or personal account does not meet those requirements.
This article explores one question; the complete overview is on AI chatbots and the GDPR.
Below, we explain this for each type of data. This is an explanation, not legal advice: assess whether processing is permitted in your situation with your data protection officer or a lawyer. The broader question is covered on the page ChatGPT, Claude, Mistral Vibe and the GDPR. Mistral's assistant is now called Mistral Vibe; it was previously Le Chat.
The GDPR recognises several types of personal data. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, sets out the categories on its page What is personal data?. Five groups matter when deciding what may go into a chat window.
In practice, these are rarely separate. A sickness absence file contains a name, a BSN and health data. The most sensitive type in the document determines what you need to arrange. That is why uploading a whole file requires more thought than typing one question; see Uploading documents to ChatGPT or Claude: what happens to them?.
Putting client data in a chatbot means processing it: you disclose it to another party for a purpose. The text of the GDPR raises four questions about this. They also apply to the more sensitive types, which have additional conditions.
Every processing activity needs one of the six lawful bases in Article 6. For a business, this is usually performance of a contract or a legitimate interest. A legitimate interest requires balancing it against the client's interests, and you must be able to demonstrate that assessment. “It's faster” does not automatically outweigh those interests, particularly where a route exists that sends less data outside the organisation.
Data was collected for a specific purpose and must not be processed in a way incompatible with it. Whether summarisation by an external AI service fits the purpose for which the client provided their data depends, among other things, on its link with that purpose, the nature of the data, the consequences for the client and the safeguards (Article 6(4)). If the provider also uses the input to improve its models, that adds a purpose the client knows nothing about.
If a provider processes data on your behalf, it is a processor and there should be an agreement setting out what it may do with the data. The major chatbots' consumer plans do not include one. OpenAI, Anthropic and Mistral do offer one for business plans. See Data processing agreements with OpenAI, Anthropic, Microsoft or Mistral: what should you check? and ChatGPT Free, Plus, Business or Enterprise: which plan can you use for business?.
Personal data may only leave the European Economic Area if its level of protection travels with it (Article 44). This can be through an adequacy decision (Article 45) or appropriate safeguards such as standard contractual clauses (Article 46). For the United States, the EU-US Data Privacy Framework applies to participating US companies. Check whether your provider is on the participant list and document the basis for the transfer. Even with a European provider, parts of the service may operate outside the EU; see Mistral Vibe and the GDPR: is a European chatbot automatically safe?.
Here, the rule is reversed. Ordinary data may be processed if you have a lawful basis. Processing special categories is prohibited (Article 9(1) GDPR), unless an exception under Article 9(2) applies. In the Netherlands, those exceptions are elaborated in Articles 22 to 30 of the Dutch GDPR Implementation Act. You therefore need two things: a lawful basis under Article 6 and an exception to the prohibition.
The best known are the data subject's explicit consent and situations described by the law itself, such as treatment by a healthcare provider, sickness absence support by an employer and conducting legal proceedings. Those exceptions were written for the core work. Whether they also cover sending the same data to a general AI service is a question of necessity, for which you need a lawyer or your data protection officer.
Special category data rarely appears in a labelled field. It appears in a sentence. “Has been at home with burnout since March.” “Requests leave for Eid al-Fitr.” “Works council member representing the trade union.” Anyone pasting an email, meeting report or client file into a chat window discloses it without noticing.
The AP warned about this following reports of data breaches. In one case, an employee at a GP practice entered patients' medical data into an AI chatbot against the agreed rules. See A data breach through an AI chatbot: when must you notify the AP?.
Special categories also often require a data protection impact assessment (Article 35 GDPR). How to assess this is explained in DPIAs for AI tools: when are they required and how do you approach them?.
These two types fall outside Article 9, but each has its own rules. The AP states this explicitly on the page mentioned above: criminal offence data and the BSN are not special category data, but special rules do apply.
Data about convictions and criminal offences may only be processed under official authority or where authorised by law. Articles 31 to 33 of the Dutch GDPR Implementation Act elaborate on this: processing is permitted only to the extent those articles allow. Examples include screening with a statutory basis, or a lawyer assisting a client.
This type occurs more often in firms than you might expect: a police report in an insurance claim file, a dismissal file involving theft, a note about fraud. Putting such a file in a chatbot requires a statutory basis for that specific processing, which rarely exists.
The GDPR leaves rules for national identification numbers to the Member States. The Netherlands has a concise rule: a number prescribed by law to identify someone may only be used to implement that law or for purposes that law specifies. On its page about the BSN, the AP summarises this as follows: organisations outside government may only use the BSN where provided for by law.
An employer has the BSN for payroll, a healthcare provider for billing. None of those laws mentions summarising a client file with a chatbot. The BSN therefore does not belong in a chat window, even on a business plan. It appears in more places than you might think: a payslip, a copy of an identity document, an insurance schedule.
The table summarises the previous sections. It is a reference, not a decision tree: every row assumes that the rules above it have also been addressed.
| Data type | Examples | What you need before it may go into a chatbot | What goes wrong in practice |
|---|---|---|---|
| Ordinary personal data | Name, address, email address, client number, contents of a complaint | Lawful basis (Article 6), a compatible purpose, no more data than necessary, a data processing agreement, a transfer basis, an entry in the record of processing activities | A personal account without an agreement, a whole document for one question, nothing documented |
| Special categories | Health, ethnic origin, religion, trade union membership, sexual orientation | Everything above and an exception to the prohibition (Article 9(2) GDPR, Articles 22 to 30 Dutch GDPR Implementation Act), usually a DPIA | The data is in a subordinate clause and nobody recognises it as special category data |
| Criminal offence data | Conviction, police report, well-founded suspicion of fraud or theft | Everything required for ordinary data and a statutory basis (Article 10 GDPR, Articles 31 to 33 Dutch GDPR Implementation Act) | A dismissal or insurance claim file is treated as an ordinary HR or client file |
| BSN | Payslip, copy of an identity document, insurance schedule | A law specifying this use (Article 46 Dutch GDPR Implementation Act); generally none exists for a chatbot | The number is at the top of a document and is included unnoticed |
| Confidential business information without personal data | Price list, source code, strategy, draft acquisition document | No GDPR requirement; permission under your own policy, confidentiality agreements and a plan without training on input are still needed | A name or signature turns out to be included, or the client contract prohibits sharing |
The GDPR concerns natural persons. According to the AP, information about an organisation is not personal data unless it also says something about a person, as with a sole trader or an email address used by one employee. A cost calculation or a piece of source code therefore falls outside the GDPR. That does not make it freely shareable.
The Dutch Trade Secrets Protection Act protects information that is secret, has commercial value because of that secrecy, and for which the holder has taken reasonable steps to keep it secret. Sharing a secret without agreements with a service allowed to use input to improve models makes it harder to argue later that those steps were taken. How a court would weigh this is a question for a lawyer.
There are also agreements with others. A non-disclosure agreement with a client or supplier often prohibits sharing with third parties without permission. An AI provider is a third party. Lawyers, civil-law notaries and accountants also have professional secrecy obligations; see Professional secrecy and AI: what lawyers, civil-law notaries and accountants need to know.
A ban works poorly: employees switch to a personal account, and you lose sight of what is shared. Arrange things in this order.
Step 5 is where most organisations get stuck. Removing names by hand takes time and something always remains. Pseudonymisation replaces direct identifiers with codes and keeps the key separately. This reduces the risk, but for the organisation holding the key it remains personal data. See Pseudonymising or anonymising: the difference, and why it matters for AI.
PrivaSearch was built for step 5: making documents containing personal data searchable for an AI assistant without the assistant seeing the personal data. It sits between your documents and the AI model. You upload files or connect a SharePoint library, which is read only.
Detection takes place inside PrivaSearch itself, without an external AI provider. Names, addresses, BSNs, IBANs, Dutch number plates and dates of birth are replaced by pseudonyms that remain the same for the same name within a project. A colleague then sees the original alongside the pseudonymised text, adds what the model missed and approves it. Only then does a document become searchable. This review is mandatory because automatic detection is never complete. The steps are on How PrivaSearch works.
You can search in PrivaSearch itself, with passages and a source reference, or through an AI assistant with an MCP connection. That connection works with Claude, ChatGPT Business and Mistral Vibe. The assistant receives only released, pseudonymised passages, limited in number, without a file, filename or link. What you type into the assistant yourself goes directly to the provider. Do not type names there, and connect a business account with a data processing agreement.
What PrivaSearch does not do is make the assessment for you. Pseudonymised data remains personal data for your organisation, so the lawful basis, the exception for special categories and the DPIA remain your responsibility. Your environment creates starter documents for these; the documents available are listed on The GDPR and the EU AI Act. For where processing takes place, see Hosting in the EU.
To see what this looks like with your type of client file, book a demo.
Not without arrangements. Entering personal data is processing that requires a lawful basis, an appropriate purpose, a data processing agreement with OpenAI and a basis for transfers outside the EU. ChatGPT Free, Go, Plus and Pro do not include a data processing agreement. A business plan can be used for ordinary personal data if you have documented this and share no more than necessary.
No. Information about a company as a legal person is not personal data. This changes as soon as the information also says something about a human being. The Autoriteit Persoonsgegevens gives the examples of a company name derived from someone's name and a business email address used by just one employee. A contact person in a quotation is therefore personal data.
Generally not. Health data is a special category: processing is prohibited unless a statutory exception applies. Those exceptions were written for healthcare, sickness absence support and similar tasks, not for sharing with a general AI service because it saves time. Ask a lawyer or your data protection officer to assess whether an exception applies in your case.
No, unless a law explicitly specifies that use, which is generally not the case for a chatbot. In the Netherlands, a number prescribed by law to identify someone may only be used to implement that law or for purposes that law specifies. A business plan does not change this.
Usually not. A person can also be identified from a combination of data: a job title, a place of residence, a date, an unusual sequence of events. As long as someone can reasonably work out who the text is about, it remains personal data. Removing information reduces the risk, but does not automatically make a client file anonymous.
As controller, the organisation is responsible for what happens to its clients' data, even if an employee acts on their own initiative. If this goes against the agreed rules, the Autoriteit Persoonsgegevens considers it a data breach, and notification is required in many cases.
For each Claude plan: what happens to your input, how long it is kept, whether an agreement is in place and where your data is stored. October 2026.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
How a healthcare practice or healthcare administration uses PrivaSearch and its own AI assistant to search intake reports, care contracts and complaint files.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →