On 14 July 2026, the Dutch Data Protection Authority (AP) published two new documents to help organisations use generative AI responsibly. The timing is no coincidence: in two weeks, on 2 August 2026, national supervisory authorities start actively enforcing the EU AI Act. The AP is now combining that with clarity on the GDPR obligations that have applied for longer.
Two documents, two audiences
The AP published:
- Guidance on generative AI and the GDPR, for developers who build or train AI models themselves. This document sets out which legal basis is required, which safeguards you must build in and how to handle training data that contains personal data.
- Tool on generative AI and the GDPR, a practical checklist for organisations that deploy AI tools (think ChatGPT, Copilot or Claude). Step by step, you can assess whether your use complies with the GDPR.
Both documents are freely available via the AP website.
Legitimate interest is no blank cheque
A key point stands out: the AP states explicitly that organisations cannot automatically rely on legitimate interest when developing or using generative AI. Anyone who wants to rely on that basis must be able to answer three questions:
- Is there a legitimate interest? This must be concrete and demonstrable.
- Is the processing necessary? If comparable datasets are available without personal data, the necessity test fails.
- Does the organisation's interest outweigh the rights of data subjects? With scraping of public sources, that is rarely a foregone conclusion.
This is particularly relevant for organisations that fine-tune models themselves or use internal business data to train AI.
Privacy risks start before the first output
The AP stresses that privacy measures must be built in from the start of an AI project, not added afterwards. In practice this concerns:
- Data minimisation when assembling training sets
- Defining retention limits for model inputs and outputs
- Making data subject rights (access, correction, erasure) technically possible
- Transparency towards users about which data is processed
For organisations that purchase AI tools, and therefore act as data controller, it is essential to check whether the provider meets these requirements. The security page gives you an overview of the privacy position of the main models.
Combined with the AI Act, the pressure increases
With enforcement of the AI Act starting on 2 August, plus this new GDPR guidance, compliance obligations are piling up. In practice this means: if you have not yet updated your processing register for your AI tools, or have not concluded a data processing agreement (DPA) with your AI provider, this is more urgent than ever.
Which models offer EU data residency, and which providers let you check where processing takes place, is set out on the models page. For those working in healthcare, government or financial services, our sector overview page is also a good starting point.
Sources: AP – guidance on generative AI and the GDPR, 14 July 2026 · Security.NL – AP: legitimate interest for using and developing AI is not self-evident · Advocatie.nl – AP helps developers with new GDPR guidelines