Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Dutch DPA finds businesses unprepared for handling algorithms and AI, will provide guidance

Sixteen hundred businesses were surveyed by the Autoriteit Persoonsgegevens (AP) on 16 April 2025, revealing the Dutch business community feels insufficiently prepared for handling algorithms that process personal data. The AP will collaborate with businesses to provide information and practical tools. This initiative follows findings that most companies are unsure if they use algorithms for personal data processing, and often do not know what type of algorithms they employ.

The survey results indicate that when businesses do use algorithms for personal data processing, they frequently lack specific knowledge about the algorithm types involved. Businesses also report insufficient understanding of relevant rules and risks associated with algorithmic processing. A significant dependency on suppliers or other external parties for acquiring software that uses algorithms affects procurement practices and limits control over usage risks. The AP will examine supplier responsibilities and provide guidance on algorithm procurement, encouraging critical consideration of purpose and risks during the purchasing process to prevent adverse consequences for customers.

Following these findings, the AP engaged with businesses and identified several next steps. The AP plans to increase its publication of practical tools and conduct consultations on the responsible deployment of algorithms, such as the recent consultation on ensuring meaningful human intervention in algorithmic decision making. The AP is also developing a checklist to help companies manage the rights of individuals affected by algorithmic decisions. The AP will further engage with businesses to collect best practices for setting up and implementing algorithms that process personal data.

The increasing adoption of artificial intelligence (AI) systems across various sectors, as highlighted by the Autoriteit Persoonsgegevens (AP) on 16 April 2025, consistently challenges organisations to maintain data protection compliance.

Original title: Bedrijfsleven geeft zichzelf onvoldoende voor omgang met algoritmes

Survey findings by the Autoriteit Persoonsgegevens

Who this binds
Organisations processing personal data in the Netherlands are bound by the General Data Protection Regulation (GDPR), and this publication offers advisory guidance.
What changed
The Autoriteit Persoonsgegevens (AP) committed to publishing more practical tools and consulting on responsible algorithm deployment, including a checklist for managing individual rights, following its 16 April 2025 findings.
What to watch
Organisations should monitor upcoming guidance and tools from the Autoriteit Persoonsgegevens (AP) regarding algorithm procurement and the management of individual rights in algorithmic decision making.
What this does not mean
This does not mean that the Autoriteit Persoonsgegevens (AP) has issued new legally binding regulations or enforcement actions on algorithms; it is a statement of intent for future guidance.

Send this to your team

The Dutch Autoriteit Persoonsgegevens (AP) found that 1600 businesses are unprepared for handling algorithms and AI, and will provide guidance and practical tools to help organisations manage personal data processing risks.

Today's question

The Autoriteit Persoonsgegevens (AP) found that many Dutch businesses are unsure about their use of algorithms for personal data processing and lack knowledge about algorithm types. What is a key area the AP plans to address to help businesses manage these challenges?

  1. Providing guidance on algorithm procurement and critical consideration of purpose and risks.
  2. Developing new legislative frameworks to regulate the use of all algorithms in the Netherlands.
  3. Establishing a mandatory certification programme for all algorithm developers and suppliers.
  4. Implementing a system for direct AP approval of every algorithm used by Dutch businesses.

Answer this question on the site

Worth knowing

  1. Brazilian court rules salary transparency policy is constitutional and does not violate LGPD

    Brazilian companies with 100 or more employees must ensure compliance with Law 14.611/2023 by preparing and disclosing Salary Transparency and Remuneration Criteria Reports, as this obligation has been affirmed as constitutional and compatible with the LGPD.

  2. Natural Resources Wales confirms data breach due to human error

    The confirmation of a data breach at Natural Resources Wales, caused by human error, illustrates the persistent risk that internal processes and staff training pose to data security for public sector bodies.

  3. How the R$14,000 fine for Telekall escalated to R$153 million for TikTok

    This analysis from JOTA signals that the Brazilian National Data Protection Authority's enforcement posture is maturing, indicating that data protection compliance is becoming a material financial risk for companies operating in Brazil.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.