AI and privacy in the Netherlands: which services are GDPR-compliant?

"Is this AI GDPR-compliant" is an understandable question with an awkward answer: no service is compliant on its own. What makes a service suitable or not depends just as much on what you paste into it and what agreements you've made with the provider. A chat about your holiday plans and a chat about a personnel file are two completely different situations with the same provider.

What you can compare per provider are three concrete things: where your conversations are processed, whether they're used for training by default, and whether there's a data processing agreement you can request. That's what this article is about. We stick to what's established and don't fill the gaps with assumptions.

This isn't legal advice. If it involves data of customers, patients or employees, the provider's own data processing agreement always takes precedence.

What you're really asking with "is this GDPR-compliant"

Behind that one question there are usually four.

Where is the server? That determines whether data leaves the EU and which arrangements are needed for that.

Who can read it? Besides the provider itself, this is about whether conversations are used to train models and how long they're kept.

What have I agreed to myself? For business use, that's the data processing agreement, and it's far from included with every consumer subscription.

And above all: what am I actually putting into it? That's the question you have the most influence over yourself, and the cheapest way to reduce your risk.

Where is your conversation processed

Below is only what's established. Where we have no confirmed information about the processing region, the table says so, instead of guessing.

The most important rule for this table: the "not established" column doesn't mean "unsafe". It means we have no confirmed information about it and that you need to check it before putting anything sensitive into it.

For anyone looking for the shortest path here: Mistral is the only major consumer chat where European processing is simply the starting point. That's also exactly why the name keeps coming up in the discussion about the shift to European providers.

Who can read along: training and retention periods

Training settings are where most users can gain something without switching services, and also where the providers differ most from each other.

With Claude, training is off by default on paid consumer plans. That's the most favorable starting position among the major American providers: you don't have to do anything to stay out of it. If you do turn it on, that also extends the retention period of your conversations, so it isn't a neutral switch.

With ChatGPT and Gemini the responsibility lies with you: you have to turn training off yourself. It's a thirty-second setting, but one that most people never touch.

Le Chat Pro also includes a no-telemetry mode, which goes further than just training: it limits what usage data is sent at all.

What a data processing agreement is and when you need one

A data processing agreement, in Dutch a verwerkersovereenkomst, or DPA, is the written arrangement between you and a service about how that service processes data on your behalf. It states what the data may be used for, how long it's kept, which safeguards are in place and what happens when you stop.

For private use, this doesn't concern you. As soon as you use AI for work that involves other people's data — customers, patients, students, job applicants, employees — it becomes relevant, and it's standard practice to conclude such an agreement with every service you use in that chain.

In practice, it comes down to this. Request the agreement from the provider before you start, not after you've been at it for three months. Read the passages on retention periods, use for training and sub-processors specifically. And keep the document somewhere you can find it again, because you'll need it as soon as someone asks for it.

Also note the difference between a consumer subscription and a business subscription. Business plans exist largely because different arrangements sit behind them: ChatGPT Business costs $20 per user, Claude Team $20 per user with a minimum of five users on an annual basis, and Microsoft 365 Copilot Business about €19 per user. What that means for a small business is covered in AI for freelancers and small businesses.

Practical advice per situation

A few notes. If you work privately and no data of other people ends up in your prompts, this is mainly a matter of checking your training setting and otherwise simply choosing on quality and price. Claude is a pleasant choice then, because it's set correctly by default on paid plans, and because it writes the best Dutch of all the services. What else sets Claude apart is covered in Claude AI explained.

If you work with customer data, the order is reversed: first determine what's allowed, and only then look at which model works best. At €15.76, Le Chat Pro is then the cheapest route to European processing.

What a bundled subscription does and doesn't solve

There's one thing we don't want to make sound better than it is. A subscription that bundles multiple models, like ours, doesn't change where the underlying model runs. If you ask something of a model from an American provider, it's processed there, regardless of which interface you use.

What a bundle does solve is the practical side: you can choose the model that fits each task, instead of being stuck with the provider you happen to have a subscription with. For sensitive work you then deliberately choose a different model than for the rest. And you get one invoice in euros including VAT, which is administratively simpler than three separate subscriptions in dollars. The cost side of that is in our comparison of AI subscriptions.

Conclusion