Putting financial data into AI: is it allowed under the GDPR?
Company figures are not always personal data, but a set of records almost always contains some. What the GDPR requires when you use AI for bookkeeping and annual accounts work, and what you arrange yourself.
The short answer
Yes, if you follow the GDPR. Company figures of a BV are usually not personal data, but salaries, the current account with the DGA and the records of a sole proprietorship are. Use a business AI service with a data processing agreement for those, send no more than necessary and know where the data is processed. They do not belong in a personal chat account.
Updated 30 October 2026
Key facts
| Personal data | Anything relating to an identifiable person (art. 4(1) GDPR) |
| Agreement with the AI service | A data processing agreement if the service processes on your behalf (art. 28(3) GDPR) |
| As little as possible | Only the data that is necessary (art. 5(1)(c) GDPR) |
| Outside the EEA | Structurally with an adequacy decision or appropriate safeguards; limited exceptions besides (art. 44 and 49 GDPR) |
| Retention | The records for seven years (art. 2:10(3) DCC, art. 52(4) AWR) |
Which financial data is personal data
The GDPR protects natural persons, not BVs. The turnover or balance sheet total of a legal entity therefore falls outside it. Yet records almost always contain data about identifiable persons (art. 4(1) GDPR):
- the salary and pension costs of the director-major shareholder, and in a small company payroll costs that can be traced to one employee;
- the current account with the DGA, loans to directors and their remuneration. A medium-sized or large legal entity states the remuneration of directors collectively in the notes, but may omit that disclosure if it is traceable to one natural person (art. 2:383(1) DCC); a small one is exempt from the disclosure (art. 2:396(5) DCC) and a micro legal entity has no notes (art. 2:395a(6) DCC);
- names in the accounts receivable and payable records if the customer or supplier is a sole proprietorship;
- bank transactions with names of counterparties, and purchase invoices with addresses;
- for a sole proprietorship or vof: the entire records, because they are about the entrepreneur personally.
Payroll data requires extra care. A citizen service number (BSN) may only be used where the law permits it (art. 46(1) UAVG, the Dutch GDPR Implementation Act), and data about illness concerns health, a special category (art. 9(1) GDPR). Such data does not belong in an AI service that you use for text or explanations.
Personal chat account or business service
The difference lies not in the model but in the agreements. If you have personal data processed by a service that does so on your behalf, you conclude a data processing agreement with the content prescribed by art. 28(3) GDPR: processing only on your instructions, confidentiality, security, sub-processors only with your permission, and deletion or return afterwards.
With a free or personal account of a chat service, such an agreement is usually missing. You then accept consumer terms, and the provider's settings determine whether your input is used to improve models. Business subscriptions and API access more often come with a data processing agreement. Read the provider's terms yourself, and record which services your organisation may use.
If an employee has pasted payroll data into a chat service without such agreements, check whether it is a data breach. If a risk to the data subjects is not unlikely, you report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (art. 33(1) GDPR).
Five rules for AI in bookkeeping and annual accounts work
- Send only what is necessary (art. 5(1)(c) GDPR). For a note on tangible fixed assets, a model does not need employees' names.
- Choose a service with a data processing agreement, and check which sub-processors that service engages.
- Know where the data goes. Structural transfer outside the EEA requires an adequacy decision (art. 45(1) GDPR) or appropriate safeguards, such as the European Commission's standard contractual clauses (art. 46(2)(c) GDPR). Art. 49 GDPR also provides limited exceptions for specific situations; you do not build a standing practice on them.
- Do not let the AI decide. A suggestion that you review is not an automated decision; an outcome that significantly affects someone without human intervention can be one (art. 22(1) GDPR).
- Record it in your record of processing activities (art. 30(1) GDPR): which AI service, for what purpose and with which data.
What Jaarrekening.io sends to AI
Jaarrekening.io uses language models from Anthropic via the commercial API, for functions that you start yourself. For each function only what that function needs is sent:
| Function | What goes to Anthropic |
|---|---|
| Mapping of accounts without an RGS code or earlier choice | Account number, account name and balance of those accounts |
| Trial balance, movement overview or prior-year annual accounts as PDF | The document you upload |
| Drafts for the notes and the management report | The recorded figures, your confirmed answers and data about the legal entity |
| AI review, figures check and style check | The text of the section and the recorded figures |
| Entry suggestion for a bank transaction | Description, counterparty and amount, with up to forty previously processed bank transactions as examples; what the app regards as salary stays out |
| Having a purchase invoice or receipt read | The document, with the printed details of supplier and customer |
| Looking up a company when creating a legal entity | The search query, to search public sources for data that the source of the Business Register used does not provide, such as directors; you confirm what was found |
The payroll administration itself, with employee data, payslips and citizen service numbers, does not go to Anthropic. By default, Anthropic does not use API input and output for model training and deletes them within 30 days according to the standard API retention period, except for safety, legal or separately agreed exceptions. Requests may be processed in several regions, and by default Anthropic stores them in the United States; that transfer rests on the standard contractual clauses or the EU-US Data Privacy Framework. The app's primary database is in the EU.
For your records you are the controller and Jaarrekening.io is the processor; the data processing agreement applies to that. All sub-processors are listed on Security & Privacy, the rest in the privacy statement. What an AI function suggests is a draft that you review and confirm yourself; the content of the annual accounts remains the responsibility of the board (art. 2:362(1) DCC).
AI Act and retention duty
The European AI Act (Regulation (EU) 2024/1689) sets rules for AI systems themselves. For the personal data you put into such a system, the GDPR continues to apply; the regulation leaves it unaffected.
Besides the GDPR, the retention duty applies: you keep the records for seven years (art. 2:10(3) DCC, art. 52(4) AWR). A request for deletion does not simply override that. Export your records before you cancel a service; see also how long must I keep the annual accounts?. A checklist for the security of annual accounts software in general, from hosting to two-step verification, is at annual accounts software and the GDPR.
Sources
- General Data Protection Regulation, Regulation (EU) 2016/679 (eur-lex.europa.eu)
- AI Act, Regulation (EU) 2024/1689 (eur-lex.europa.eu)
- Art. 2:10 DCC: duty to keep records and retention period (wetten.overheid.nl)
- General State Taxes Act (AWR), art. 52: records and retention duty (wetten.overheid.nl)
- Art. 2:383 DCC: remuneration of directors (wetten.overheid.nl)
- Art. 2:396 DCC: small legal entity (wetten.overheid.nl)
Frequently asked questions
May I put my trial balance into ChatGPT?
If it contains personal data, such as the director-major shareholder's (DGA) salary or the current account with the DGA, only with a service with which your company has a data processing agreement. Otherwise remove that data first. Figures of a BV without traceable data fall outside the GDPR, but remain confidential.
Do I need a data processing agreement with an AI service?
Yes, if the service processes personal data on your behalf (art. 28(3) GDPR). In bookkeeping and annual accounts work that is almost always the case, if only through the names of directors and counterparties.
Does Jaarrekening.io train AI models on my data?
No. The app uses Anthropic's commercial API, which by default does not use input and output for model training and deletes them within 30 days, except for the exceptions in the privacy statement.
Is my data processed outside the EU?
The primary database is in the EU. With an AI function, the data needed for it may be processed outside the EU, because Anthropic processes in several regions and stores by default in the United States. This happens under the standard contractual clauses or the EU-US Data Privacy Framework.
Does my payroll administration go to AI?
Not in Jaarrekening.io. Employee data, payslips and citizen service numbers (BSN) do not go to Anthropic. With an entry suggestion, bank transactions that the app regards as salary on the basis of account, description or counterparty are also left out as examples.
Read more
Preparing Dutch annual accounts?
Your first set of annual accounts is free, for every size class. Create an account and prepare the annual accounts of your Dutch company under Title 9 of Book 2 of the Dutch Civil Code.
Get started