An AI data breach at a council: what Eindhoven teaches a year on

#The breach surfaced because the council went looking

The council only found the breach through its own spot check. That is the first lesson, and the least comfortable one: an organisation that does not look can have the same breach without it appearing in any log or register.

Most councils now have an AI policy, and often an approved tool. Which other AI services are open in a second browser tab is usually unknown. A quarterly inventory is always behind, as we describe in shadow AI in municipalities. To know whether it is happening in your organisation, you need a continuous view of which tools are in use and where sensitive data is involved, in counts and patterns rather than what any one person typed.

#Why the scale could not be established afterwards

The council knew it involved many files, but not which ones. It said the data was only available for thirty days. Whose data was in those files remained unknown.

That is what separates this from most incidents a DPO handles. With an email sent to the wrong recipient, you know which email it was. With an AI website an employee chose to use on their own, the organisation has no account, no admin console and no agreement with the provider. What was uploaded sits with the provider and in the employee's memory.

Asking the provider to delete the files, as Eindhoven did, is worth doing, but you cannot verify yourself that it happened. For a single employee and a single chat, the steps are in ChatGPT data breach: do you have to report it?.

#What to do when you cannot reach the people affected

The Dutch data protection authority already said in its 2024 warning about AI chatbots (Checked 13 November 2026) that entering personal data into a chatbot against the employer's rules is a personal data breach, and that notifying the regulator and the people affected is then mandatory in many cases. Youth care documents hold information about children and families. Where health data is involved, the Dutch regulator says you should in any case assume a high risk to the people affected.

Under Article 34 of the GDPR, a high risk means you tell the people affected without undue delay. If reaching them individually would involve disproportionate effort, for instance because you do not have their contact details, the Dutch regulator's guidance on reporting breaches (in Dutch, Checked 13 November 2026) says you may use a public communication instead, as long as it informs them equally effectively. Eindhoven made the breach public in December 2025 through a letter to the city council.

That route has its limits. A resident who reads in the local news that their family's youth care file may be sitting in an AI tool has little to act on, and the less you know about what was shared, the vaguer that public notice becomes.

#Blocking works when the alternative arrives the same day

Eindhoven blocked public AI websites and gave staff an alternative on the same day: Copilot inside its own environment. The order matters. The summary the youth care worker needed does not go away with the block. Without an alternative, the work moves to a personal phone, out of sight. We describe that pattern in what happens when you block AI without a workable alternative.

An approved tool needs its own rules. Which data can Copilot reach, which permissions are too broad, and what may someone paste into it? That work is covered in Microsoft Copilot in municipalities. The investigators also advised Eindhoven to inform staff better about using AI. A block tells people what is off limits; they also need to know why, and what they can use instead.

#What to put in place before a spot check finds something

There is no need to wait for your own spot check. Five things can be settled now.

1. Know which AI tools are in use. Continuously, in counts per tool, not per employee.
2. Make a decision per tool. Allowed, limited use or not allowed, with the condition written down. A tool without a decision is not an approved tool.
3. Provide an alternative for the work people already do. Summarising, rewriting, shortlisting. The people who do the work know which tool has to take it over.
4. Agree which data never goes into an AI tool, and make it specific to public sector work: national ID numbers, social care and youth care files, CVs. ChatGPT and personal data in municipalities sets out what to take out, task by task.
5. Decide in advance how you assess an AI-related breach. Who decides whether it goes to the regulator within 72 hours, and what you do if you do not know who is affected.

A spot check like Eindhoven's shows what has already happened. What comes before it is knowing which AI tools are in use before someone uploads a case file. See shows that, with counts and types of sensitive data, never what anyone typed. While people work, staff opening a tool the organisation has not allowed get a notice pointing to the approved alternative, and sensitive details are highlighted in the text. With the Documents module, the organisation can also set ChatGPT and Claude to hold back an attached file, so the employee can have it checked and masked before the tool sees it. How that works is on Help. For those who assess these incidents, there is AI governance for privacy officers.