When a task moves from a human to a system, often not only who does the work changes, but also how personal data is processed. An employee who assesses a customer query reads data, weighs it and decides. A system that takes over the same task processes that data in a different way: structured, repeatable, sometimes with storage or transfer that wasn't there before. The GDPR looks at the processing, not at whether a task sounds "automated". That makes automation, at its core, a data-protection event, even if the outcome for the customer appears the same.
This applies at every level of automation, from a simple script to an AI system that draws conclusions independently. Assessing a task for suitability for AI therefore also involves the question of which data is involved and whether processing it still fits within the purpose for which the data was originally collected. How we assess a task therefore pays attention to the nature of the data processing, alongside the question of whether the task itself is suitable for transfer to a system.
Three elements usually shift when a task is automated:
None of these shifts is inherently a problem. They are, however, a moment to review the processing again, rather than assuming that an existing legal basis automatically carries over to the new way of working.
Every processing of personal data needs a legal basis, for example consent, a contract, a legal obligation or a legitimate interest. That legal basis is tied to a processing activity as it was designed and assessed at the time. If the processing changes materially, the original legal basis may no longer be sufficient.
This happens more often than it seems. A legitimate interest that was weighed for manual processing does not automatically hold up if the volume, speed or scope of the processing increases significantly through automation. Consent requested for one specific purpose does not cover a second purpose added by an AI application. And automated decision-making with legal effects for data subjects is subject to additional conditions, regardless of which legal basis otherwise applies.
Whether a task falls into category one, two or three — AI can take it over, AI can partly do it under supervision, or it remains human work — therefore says nothing yet about whether the underlying data processing is covered. These are two separate assessments that are nonetheless connected: a task that stays in category two or three because of data risks often does so precisely because the legal basis or the impact on data subjects has not yet been examined.
The GDPR itself, the guidance from the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the guidelines of the European privacy supervisory authorities are the places where the current requirements are set out, including any special rules for AI applications that may change after publication of this page. We deliberately do not name article numbers or time limits here: these can change and belong in the source text, not in an overview that may no longer be current by the time you read it.
This page describes the mechanism, not tailored advice. Whether a specific automation requires a new legal basis, justifies a DPIA or touches on automated decision-making is a legal question that must be answered on a case-by-case basis, usually with a lawyer or data protection officer.
When automation affects a task carried out by multiple people, the privacy question is usually not the only one. Employee representation may also come into play: when the works council is involved explains in which cases consent or advice is required when work processes change. Both processes — the privacy assessment and employee representation — run alongside each other and do not replace one another.
This page describes what changes in GDPR processing when tasks are automated; it does not answer whether your own tasks are legally covered or suitable for transfer to AI. For an initial, non-binding indication of what portion of the hours in your profile could be taken over by AI today, you can fill in the free quickscan from ftetoai: twelve questions, no account needed. The scan concerns the content of the task, not the surrounding data processing — that assessment remains separately necessary. The full work scan, which goes deeper into individual processes, is still under development.
Vraag maar. Ik ken de kennisbank van deze site; wat ik niet weet, zeg ik erbij.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.