You can use big data and train AI models under the General Data Protection Regulation (GDPR), but only if you name a lawful basis under Article 6 GDPR before you start and the processing is necessary for that purpose. Reusing existing customer data for training is a further processing that must pass the compatibility test of Article 6(4) GDPR. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises this and can impose fines of up to €20 million or 4% of worldwide annual turnover.
Table of contents
When is a big data set personal data?
Almost always. Under Article 4(1) GDPR data is personal if it relates to a person who can be identified, taking into account all means reasonably likely to be used, by you or by anyone else.
Device identifiers, location traces, transaction records and clickstreams are therefore usually personal data, even without names. Pseudonymised data, where identifiers are replaced but a key still exists, remains personal data. Only anonymous data, where re-identification is no longer reasonably possible for anyone, falls outside the GDPR.
The bar for anonymisation is high: hashing, aggregation or removing direct identifiers often leaves enough to re-identify people. Treat a dataset as personal data unless a documented re-identification analysis shows otherwise. The European Data Protection Board (EDPB) has also stated that a model trained on personal data cannot automatically be considered anonymous, because personal data may be extractable from it.
Which lawful basis can you use for AI training?
Article 6(1) GDPR lists six grounds; for large-scale analytics only three are realistic. In most commercial settings it will be legitimate interests, supported by a written assessment.
Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give (Article 7 GDPR). It is hard to organise for a training set, because you then need a way to deal with withdrawal after a model has been trained.
Necessity for the performance of a contract is narrow. The test is objective necessity for the service the person asked for; the Court of Justice of the EU has rejected attempts to stretch this ground to behavioural advertising and personalisation.
Legitimate interests (Article 6(1)(f) GDPR) requires three documented steps: a real and lawful interest, necessity because no less intrusive means exist, and a balancing against the rights and reasonable expectations of the people concerned. The Court of Justice has confirmed that a commercial interest can be a legitimate interest, but only if the necessity and balancing tests are actually met.
What about special categories and inferred data?
Data on health, ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation, and biometric or genetic data used for identification, may only be processed under an exception in Article 9 GDPR. In a commercial setting that usually means explicit consent.
Special category data does not have to be collected on purpose. If a protected characteristic can be inferred from purchases, locations or free-text fields, the stricter regime applies. Identify features that act as proxies for such characteristics during development.
Can you reuse existing data to train a model?
Only if the new purpose is compatible with the original one. Under Article 5(1)(b) GDPR data may not be further processed in a way incompatible with the purposes for which it was collected.
The test in Article 6(4) GDPR looks at the link between the purposes, the context and reasonable expectations of the people concerned, the nature of the data, the possible consequences and safeguards such as pseudonymisation or encryption. Medical or financial records will often fail where operational logs pass. If the test is not met, you need a new legal basis and usually new information to the people concerned.
Further processing for scientific research or statistics is treated as compatible if the safeguards of Article 89 GDPR are in place. Commercial product development presented as research does not qualify. Describe purposes honestly at collection; our guide to privacy policy in the Netherlands explains how.
How do minimisation, retention and accuracy apply?
Under Article 5(1)(c) GDPR data must be limited to what is necessary. You can reconcile this with model development by documenting which fields are needed, what you tested without them and why you discarded the rest.
Storage limitation (Article 5(1)(e) GDPR) applies to training data, feature stores, model checkpoints and inference logs, each with its own retention period. Inference logs are often forgotten and may contain more personal data than the training set.
Accuracy (Article 5(1)(d) GDPR) also covers model output. An inference that someone is a poor credit risk or a likely fraudster is personal data, can be wrong, and is subject to the right to rectification in Article 16 GDPR. Build systems in which such output can be corrected.
When is a data protection impact assessment compulsory?
Under Article 35 GDPR a data protection impact assessment (DPIA) is mandatory when processing is likely to result in a high risk. This includes profiling on which significant decisions are based and large-scale processing of special category data, which covers most serious big data projects.
The AP has published a list of processing operations for which a DPIA is always required in the Netherlands, including large-scale profiling and systematic employee monitoring. Check that list at the start of every project.
Carry out the DPIA before the processing starts, which in an AI project means before the training data is assembled. If a high residual risk remains, you must consult the AP first (Article 36 GDPR). A useful DPIA for an algorithm records the data sources and legal bases, what the model decides on its own, how output is explained, how bias was tested and what happens when the model is wrong.
How does the Autoriteit Persoonsgegevens enforce?
The AP enforces the GDPR and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). It can issue warnings and reprimands, orders subject to a penalty payment, processing bans and administrative fines.
Under Article 83 GDPR fines reach €10 million or 2% of worldwide turnover for the lower tier, and €20 million or 4% for breaches of the principles, the lawful bases, data subject rights and transfer rules, whichever is higher. The AP pays particular attention to transparency and has a dedicated unit for algorithm supervision.
A personal data breach must be reported to the AP without undue delay and where feasible within 72 hours (Article 33 GDPR), and to the people concerned if the risk is high (Article 34 GDPR). This is separate from incident reporting under the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026; see our overview of NIS2 and the Dutch Cybersecurity Act.
Does the AI Act replace the GDPR?
No. The EU AI Act regulates AI systems by risk class but does not provide a legal basis for processing personal data. Where an AI system processes personal data, both regimes apply in parallel.
The bans on unacceptable practices, the rules for general-purpose AI models and the transparency duties already apply. The obligations for high-risk systems were postponed by the AI omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. Liability for damage caused by AI remains governed by Dutch contract and tort law and by product liability rules. See our guides to the EU AI Act and high-risk AI systems.
What is the risk of collective claims?
Under Article 82 GDPR anyone who suffers material or non-material damage from an infringement can claim compensation. A foundation or association can bring a collective action for damages under the WAMCA (Article 3:305a of the Dutch Civil Code), with an opt-out for people living in the Netherlands.
The Court of Justice of the EU has held that an infringement alone does not create a right to compensation: the claimant must show damage and causation, although no seriousness threshold applies to non-material damage. Individual awards in the Netherlands are modest, but a class of hundreds of thousands changes the picture. See our article on collective claims in case of mass damage.
Who is the controller when data comes from several parties?
The controller determines purposes and means; a processor acts only on documented instructions (Article 4(7) and (8) GDPR). Joint controllers must set out their responsibilities in an arrangement under Article 26 GDPR.
The label in the contract is not decisive. A supplier that reserves the right to use your data to improve its own product is, to that extent, a controller for its own purposes. Check the training clause and the sub-processor clause in supplier contracts, because transfers outside the European Economic Area require a transfer mechanism under Chapter V GDPR. Put a data processing agreement in place with every supplier that handles the data.
What should you check as an organisation?
- Have you documented the lawful basis for each processing, including training, before you start?
- Have you tested whether reuse of existing data is compatible under Article 6(4) GDPR?
- Is the DPIA done before the training data is assembled?
- Do your supplier contracts allow the supplier to train on your data?
- Are retention periods set for training data, checkpoints and inference logs?
- Can model output about individuals be corrected?
What should you check as an individual whose data is used?
- Does the privacy statement say clearly that your data is used for analytics or AI training?
- On which lawful basis does the organisation rely, and can you object or withdraw consent?
- Can you request access to, and rectification of, conclusions drawn about you?
- Has a significant decision been taken about you by automated means alone?
- Have you filed a complaint with the organisation or the AP?
What can we do for you with GDPR and AI training?
As IT lawyer we advise organisations on data-driven projects; see also our overview of the General Data Protection Regulation and our article on GDPR and AI in the Netherlands.
- We select and document the lawful basis and the legitimate interests assessment.
- We carry out the compatibility test for reuse of existing data.
- We draft and review the DPIA and handle prior consultation with the AP.
- We review supplier contracts and data processing agreements, including training clauses.
- We draft privacy statements that describe the purposes accurately.
- We represent you in AP investigations and in individual or collective claims.
Summary
- Big data sets are almost always personal data; pseudonymised data stays within the GDPR.
- Legitimate interests is the usual basis for AI training, with a documented three-step assessment.
- Reusing data for training requires the compatibility test of Article 6(4) GDPR or a new basis.
- A DPIA is usually required and must be done before the training data is assembled.
- The AI Act applies alongside the GDPR, not instead of it.
Frequently asked questions
Which lawful basis should we use for training an AI model?
In most commercial settings legitimate interests under Article 6(1)(f) GDPR, supported by a written assessment of the interest, the necessity and the balancing. Consent is hard to organise for a training set, and necessity for a contract almost never covers model development. Record the basis before processing starts.
Does the GDPR still apply if we anonymise the data first?
Only if the anonymisation really works, meaning re-identification is no longer reasonably possible for anyone. Hashing, removing names or aggregating usually produces pseudonymised data, which stays fully within the GDPR. Test and document the anonymisation and revisit it when the dataset changes.
Can we rely on the research exception to reuse customer data?
Rarely. Further processing for scientific or statistical purposes is only treated as compatible with the safeguards of Article 89 GDPR. Commercial product development does not become research because it involves data science.
What happens if someone withdraws consent after a model has been trained?
Withdrawal takes effect for the future and does not make earlier processing unlawful. You must stop using the data on that basis, which may require removing it from training sets, feature stores and logs and, where needed, retraining the model.
