Multiple workplace data leaks involving AI chatbots in Netherlands
Dozens of data protection incidents involving workplace AI chatbots were reported to the Dutch Data Protection Authority in 2025. The Municipality of Eindhoven disclosed that personal data of residents and employees were uploaded to publicly accessible AI chatbots, reportedly due to employees using these tools without adequate organizational safeguards.
What happened
The Dutch Data Protection Authority (AP) reported a steep rise in data protection incidents related to workplace use of AI-based chatbots (ChatGPT, Claude, Gemini) in the Netherlands during 2025, with dozens of reports filed in Het Financieele Dagblad.
The Municipality of Eindhoven reported a data protection incident in which files containing personal data of residents and municipal employees were uploaded to publicly accessible AI chatbots.
The AP stated that such incidents often occur because employees use AI models on personal initiative without adequate organizational rules and protection.
Reported impact
The increasing use of these AI tools raises the risk of sensitive personal data leaks.
The AP expressed concern that data entered into free versions of popular chatbots may be used to train AI models, and there is a risk that personal information could reappear in chatbot responses.
Index analysis
The AP noted that it is unclear what developers of chatbot tools do with user-entered data after collection.
Governance controls
Employees reportedly use AI models without proper organizational safeguards or data protection measures in place.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.