AI chatbot data breaches in the Netherlands: lessons from the Dutch AP

In the Netherlands, AI related data leaks are no longer hypothetical. The Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, receives breach notifications caused by employees who entered personal data into chatbots such as ChatGPT. A GP practice, a telecom operator and then a large municipality have all been affected.

These cases are valuable because they are documented. They show how the leak happens, why it is often discovered late and what the law requires afterwards. Here is what we can learn from them, and how to avoid ending up in the same situation.

The AP's warning in August 2024

In August 2024, the AP issued a clear warning: it had received several data breach notifications caused by employees entering personal data, such as patient or customer data, into an AI chatbot. According to the authority, doing so can give the company behind the chatbot unauthorised access to that data.

Two examples were given:

• at a GP practice, an employee entered patients' medical data into a chatbot, against internal agreements;

• at a telecom company, an employee entered a file that included customer addresses.

The AP points out that most providers store the data entered, often on their own servers, without the user or the people concerned knowing what happens to it.

Eindhoven: a leak measured over 30 days

In December 2025, the case of the municipality of Eindhoven became public. An internal check covering 23 September to 23 October 2025 showed that staff had uploaded personal data of residents and colleagues to public AI websites such as ChatGPT: youth care documents, internal reports and CVs, often concerning vulnerable people.

The municipality notified the AP on 23 October. It blocked access to public AI websites, offered an internal tool in a secure environment, asked OpenAI to delete the files and tightened monitoring of outgoing traffic. One point stands out: because the files had disappeared after 30 days, the municipality could not measure the full scale of the leak or inform the residents concerned.

According to the Dutch business press, the AP received dozens of such notifications in 2024 and 2025, with numbers rising from one year to the next.

Why it is legally a data breach

The AP's position is precise. If an employee uses a chatbot on their own initiative, against the employer's rules, and enters personal data, that is a data breach. If the employer allows the use, it is not a breach in the strict sense, but the AP stresses that such processing is often still not lawful. Organisations must prevent both situations.

In other words, neither a ban on paper nor permission without a framework protects the company. We break this mechanism down in our anatomy of an AI data leak.

The duty to notify

As everywhere in the European Union, the GDPR requires a data breach to be reported to the authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. For leaks through a chatbot, the AP states that a notification is required and that informing the people concerned is mandatory in many cases.

The Eindhoven case shows the practical difficulty: to notify properly, you need to know which data left, when and to which service. Without a log of what was sent to AI, the organisation is working blind. If it falls under NIS2, it must also align this notification with its cyber obligations, as explained in our article on NIS2 and AI data handling.

What the AP recommends, and what is missing

The AP advises organisations to:

1. agree clearly with staff whether chatbot use is allowed or not;

2. specify, if use is allowed, which data may be entered and which may not;

3. consider an agreement with the provider so that entered data is not stored.

These steps are necessary, but they rely on everyone's discipline. Yet the cases reported to the AP involve precisely employees who acted against the rules. We explain why in our article on why AI security training falls short.

Prevention in practice

Blocking every AI website, as Eindhoven did, stops the leak but also stops useful work. A finer approach places a control at the exact moment text or a file leaves for the assistant:

• detection of personal and sensitive data in prompts and files;

• automatic anonymisation, warning or blocking depending on the type of data;

• a timestamped log of every incident, useful for deciding quickly whether to notify.

That is what an AI DLP solution does. It also covers shadow AI, the uses IT teams never see.

Key takeaways

The Netherlands offers one of the few documented track records of chatbot data leaks. The AP has received real notifications, from a GP practice to a municipality. Entering personal data into a chatbot against internal rules is a data breach, with a notification duty attached. The best defence combines clear rules with a technical control that acts before sending and leaves a record.

Want to see how ZeusLock stops these leaks before they turn into a notification to the AP? Book a demo.