Skip to main content
Praxikon
Agent check

Enforcement

Dutch DPA study: algorithms and AI at debt collection agencies

Date
Status
final
Body
Autoriteit Persoonsgegevens
Reference
Onderzoeksrapport Automatische incasso: algoritmes en AI bij incassobureaus (29 bureaus)

What it is about

The Dutch DPA studied 29 debt collection agencies. They already use algorithms and AI widely, also for core processes: estimating the chance of collecting, enriching files, detecting vulnerability, analysing phone calls and setting the channel and frequency of contact. The DPA considers it plausible that prohibited fully automated decision-making occurs in practice without agencies realising it. Some use too narrow a definition of personal data and they rarely inform debtors actively. This is a sector study with recommendations, not a fine or a binding decision.

What this means in practice

If you use AI in debt collection, the DPA names five points: map which personal data you process and test the legal basis and necessity, actively inform debtors about the algorithms and their rights, ensure meaningful human intervention in decisions with significant effects, agree terms with suppliers and check them, and manage the risks. According to the DPA, systems that assess creditworthiness or the willingness to meet payment obligations are high risk; whoever develops them must meet the requirements from 2 December 2027. Registration for the round table of 2 December 2026 is open until 11 November 2026.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, AP informeert incassobureaus over verantwoorde inzet AI (met onderzoeksrapport als PDF)checked on 5 November 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 15

Guidelines8 of 15

Enforcement and fines8 of 14

Legislation in motion6 of 10