Dutch AP Publishes GDPR Guidance for Generative AI
On 13 July 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) published guidance and a practical self-assessment tool for organizations developing or deploying generative AI systems. The materials set out the AP’s view of how the GDPR applies throughout the generative AI lifecycle and offer a structured questionnaire to assess deployment readiness. They form part of the AP’s wider generative AI strategy, following its annual plan, vision paper, and earlier work on GDPR conditions and automated decision-making.
The AP organizes its assessment framework around three stages. First, organizations should ensure that their data governance foundations are in order. This includes maintaining an accurate record of processing activities, identifying which personal data and systems are involved, applying access and authorization controls, and putting suitable processor arrangements in place where cloud providers are used.
Second, organizations must select a generative AI system that can support compliance with the GDPR’s core principles. The AP expects clearly defined, specific, and legitimate purposes; broad objectives such as improving efficiency or supporting staff will generally not be enough. Organizations should be able to explain why personal data is needed, which data categories are processed, and how the model is used. The guidance also stresses transparency, data minimization, storage limitation, privacy by design and by default, and appropriate contractual arrangements with AI providers.
Third, the AP expects continuous governance after deployment. Organizations should carry out vendor due diligence, including on the lawfulness of model training where sufficient information is available. They should implement safeguards against inaccurate outputs and the reproduction of personal data, monitor model behavior, and update controls as risks and technical capabilities develop. The AP recognizes that data subject rights can be difficult to apply where personal data may be embedded in model parameters, but identifies output filtering as an important current safeguard.
The guidance confirms that generative AI compliance is not a one-time procurement exercise. Organizations should use the tool as a baseline for new and existing deployments, assess whether a data protection impact assessment is required, document vendor assessments, and establish processes for output monitoring and rights requests. The AP notes that its positions may change in response to future European Data Protection Board guidance or EU legislative developments, making ongoing regulatory monitoring essential.
