Guides

Dutch data and AI: how to handle IBAN, BSN, postcodes and phone numbers

By Dehumanize14 November 20262 min read

Dutch organisations handle a lot of identifiers that are personal data under the GDPR: citizen service numbers (BSN), bank accounts (IBAN), addresses with postcode and house number, and Dutch phone numbers. Before text with these goes into an AI chat, they should be replaced.

The Dutch identifiers to watch

• BSN. Nine digits, with a checksum known as the 11 check. A BSN gets extra protection and has strict rules about who may process it.
• IBAN. A Dutch IBAN starts with NL, followed by two digits, four letters for the bank and ten digits.
• Postcode and house number. Four digits and two letters, usually with a house number. Together they point to one address.
• Phone numbers. Both mobile numbers starting with 06 and numbers with +31.
• VAT and company numbers. Less sensitive, but they can identify a sole trader as a person.

What to do

1. Replace each identifier with a numbered placeholder, and keep the same one for the same value.
2. Keep the context the model needs: the role of the person, the amount, the date.
3. Restore the values locally after you get the answer.
4. Keep a note of how your team handles this, so that it is the same for everyone. See the GDPR checklist.

Tooling

Scrub for AI was built with these cases in mind. It recognises IBANs, postcodes, Dutch phone numbers and VAT numbers, and a BSN when it appears after the word BSN and passes the 11 check. Everything runs in your browser. Always read the result before you share it, because pattern recognition cannot promise to find every case.

This note is general information and not legal advice. For decisions about what your organisation may share with an AI provider, ask your data protection officer.

More: all guides · Scrub for AI · Copy for AI · Tables for AI