Guidance on generative AI and the GDPR

The first Dutch interpretation of the GDPR for the development and deployment of generative AI models, intended for organisations that build such models or are responsible for their use. The guidance addresses the legal basis for processing in detail and also works out further GDPR requirements for development and deployment. It builds on the earlier opinion from the Dutch Data Protection Authority on generative AI and refers to the obligations that the AI Act imposes on general-purpose AI model providers. The document is dated June 2026 internally and was published on 13 July 2026.