The Dutch Data Protection Authority (AP) has published guidance aimed at regulating the development and use of generative artificial intelligence (AI) in compliance with the GDPR.

The authority has published guidelines intended for developers and those responsible for deploying generative AI models. This document offers an initial interpretation of the GDPR in this context, specifying the conditions and legal bases for processing personal data. It addresses topics such as safeguards for the rights of data subjects, management, cleaning and retention of data, as well as their use for training models.

Additionally, a practical tool in the form of a checklist is offered to organizations considering acquiring or using generative AI. This instrument aims to help professionals assess the compliance of their project with GDPR obligations and determine the required technical and organizational measures. The AP primarily recommends exploring uses that do not require personal data.