The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has told the country’s debt collection industry that its growing use of algorithms and AI is running ahead of its understanding of the law. In a report and set of recommendations published on October 29, 2026, the regulator said collection agencies are using automated systems for core decisions about people who are often in financial difficulty, that many do not fully know which rules apply, and that it considers it plausible that legally prohibited fully automated decision-making is already happening without the agencies realizing it.
The report is not an enforcement action and names no companies. It is a sector review followed by guidance, the kind of document regulators issue before they start opening cases.
How the AP ran the review
According to the AP’s research report, which is published in Dutch and which we have translated, the regulator selected 29 private, out-of-court collection agencies from the Dutch register of debt collection services. That is about 13% of registered agencies at the time. Seventeen were chosen because their websites said they used AI; twelve because they gave no such information. The AP sent questionnaires on October 9, 2025, with a deadline of December 1, 2025, and received usable answers from 22 agencies. It also reviewed the privacy statements of agencies that said they used algorithms.
Of the 22 respondents, 10 said they used at least one algorithmic system. All 10 used rule-based algorithms, and three also used one or more AI systems. The AP stresses that the results describe practices that occur, not how common they are across the sector. Because it only sampled registered agencies, which it assumes try to follow the law, it describes the findings as a best-case picture.
The context explains the regulator’s interest. The report notes that one in eleven Dutch households has problematic debts and that the Netherlands has more than 2,500 collection agencies, according to estimates it cites.
What the agencies use algorithms for
The AP lists six main uses it found:
- Choosing communication channels and frequency. “If-then” rules decide whether to contact a debtor by letter, email, phone or text and how often, using contact data, payment history and the size of the debt. Some agencies only get a suggestion; others contact debtors automatically.
- Automated interactions and payment arrangements. Chatbots, voice systems and language models handle debtor questions, and some agencies approve new payment terms or deferrals fully automatically. Some said only approvals are automated, while refusals are always handled by people.
- Estimating the chance of collection. Systems score how likely a debt is to be collected using variables such as credit score, the debtor’s location, payment history, the age of the debt and business activity. Staff use the score to decide whom to contact first.
- Enriching debtor files. Systems search registers and the internet for additional information, including contact details, bank details, company data and social media activity, which then feeds into all other processes.
- Detecting vulnerability. Algorithms estimate whether a debtor is vulnerable, for example from behavior patterns or presence in certain registers.
- Analyzing phone calls.
The AP says two of these, file enrichment and vulnerability detection, raise fundamental questions about lawfulness.
The regulator’s main concerns
The report identifies several gaps. Some agencies use an incorrect, overly narrow definition of personal data, which means they may not apply principles such as accountability and proportionality to risky processing. It is often unclear whether decisions with significant effects on debtors are automated in the sense of Article 22 of the GDPR, which restricts decisions based solely on automated processing. Transparency is weak: all the agencies said they had a privacy statement, but it is rarely shared actively at first contact, and clear explanations of algorithm use and debtors’ rights are often missing. Many agencies say they build in human review, but the AP says it is not always clear whether that review is meaningful or merely a formal step.
“If you are dealing with debt collection, it can have serious consequences for you. You may have to pay a lot of money. And AI can make mistakes too,” AP board member Katja Mur said in the regulator’s announcement (our translation). “That is why it is important that it is clear and transparent how a decision is reached, and that there is a flesh-and-blood collections employee who can be held accountable. Otherwise you are completely in the dark while AI decides about you.”
The AP’s five recommendations
- Awareness and data use: map which personal data is processed and test it against the GDPR, including the lawful basis and necessity.
- Transparency: improve information to debtors, with clear explanations of algorithmic processing and active communication of their rights.
- Automated decision-making: ensure human intervention that is genuinely meaningful for decisions with significant effects on debtors.
- Supplier management: agree clearly with technology suppliers on compliance with laws and regulations, and check that suppliers keep those agreements.
- Risk management: develop measures that match the identified risks and build knowledge of them within the organization.
The AP will hold a roundtable with organizations from the collection industry on December 2, 2026 to discuss the findings and hear about practical obstacles. Industry organizations that want a seat must register by November 11, and the AP says it will select participants if demand exceeds places.
Why it matters beyond the Netherlands
Debt collection is a sector where profiling and automated decisions have direct financial consequences for people who are often already vulnerable. The AP’s concerns map onto obligations that apply to any GDPR controller doing similar things, including banks, utilities, telecoms and buy-now-pay-later providers that run their own collections.
The Dutch regulator has a record in this area. It fined Experian 2.7 million euros over credit-scoring practices, which we covered in the Experian fine analysis, and has issued guidance on generative AI, summarized in its GDPR playbook for generative AI. A sector report like this one often signals where it will look next.
Several of the AP’s points are also general lessons:
- Collection-probability scores and vulnerability flags are forms of profiling and need a lawful basis, a necessity assessment and, often, a DPIA.
- Information duties under Articles 13 and 14 apply from the first contact, including when data comes from third-party sources such as registers or the internet. Our guide to what Articles 13 and 14 require in a privacy notice sets out the elements.
- Human review that never changes an outcome is unlikely to count as meaningful intervention.
- Buying an algorithm from a vendor does not transfer accountability. The AP’s supplier recommendation fits squarely within a third-party risk management framework.
Debtors who want to know how a decision about them was made will exercise access and objection rights. Captain Compliance’s data subject request workflows can help organizations receive, route and document those requests, and its assessment tools can record DPIAs and vendor reviews for scoring systems. Neither replaces the legal analysis the AP is asking for.
Frequently asked questions
Did the AP fine any debt collection agency?
No. The report is a sector review with recommendations. It does not name agencies or find specific violations, though it says it considers prohibited automated decision-making plausibly present in practice.
Is all automated decision-making in debt collection banned?
No. Article 22 of the GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects, with exceptions such as explicit consent, contractual necessity or authorization by law, and safeguards including the right to human intervention. Rule-based systems that only suggest actions to staff are generally outside it if the human review is real.
Does the report apply to companies collecting their own debts?
It focused on registered out-of-court collection agencies. But the GDPR obligations it discusses apply equally to any organization that uses algorithms to collect money owed to it.
What happens next?
The AP will meet industry representatives at a roundtable on December 2, 2026. Agencies should expect follow-up questions on the five recommendation areas.
The collector on the other end of the line
Debt collection has always involved judgment about whom to chase, how hard and when to offer more time. The AP’s report shows that more of that judgment is moving into scores and rules that debtors cannot see and agencies do not always understand. The regulator has asked for a person who can explain each significant decision. The open question for the industry is whether it can still find one after the systems have been running for a few years.
