Download this document as PDF | Dutch version
This is an English translation of the approved Dutch DPIA. In case of discrepancies, the Dutch version prevails.
Joni uses Retrieval-Augmented Generation (RAG) to temporarily retrieve personal data from JOIN for better answers, but it does not store this data and does not learn from it.
The main security measures are:
Conclusion: The RAG functionality does not introduce new privacy risks and remains fully within the GDPR and the European AI Act.
The AI chatbot Joni supports users in finding and understanding information within the JOIN system. With the new Retrieval-Augmented Generation (RAG) functionality, Joni can also use personal data solely to provide contextual answers to the user who already has access to it.
This processing is necessary to improve the efficiency and usability of JOIN and remains within the existing purpose limitation of the system. No new personal data is collected or permanently processed outside JOIN. Joni acts as an intelligent search and answer layer.
Important conditions:
Categories of data subjects:
Categories of personal data:
The processing is necessary to support JOIN users more efficiently in their work. No new data is collected; Joni only uses information that the user could already view through the normal JOIN interface. Processing is limited: personal data is not stored but only used temporarily for the specific answer.
| Risk | Explanation | Likelihood | Impact |
|---|---|---|---|
| Unauthorized access via Joni | AI displays data to someone without rights | Low | High |
| Unintended disclosure in answers | AI may include irrelevant personal data in an answer | Medium | Medium |
| Storage or reuse of sensitive data | AI might retain data and reuse it later | Low | High |
| Profiling or secondary use | Data from AI conversations is used elsewhere | Low | High |
Authentication and authorization
Joni always logs in as the same user who is authenticated in JOIN. OAuth is used, ensuring Joni never has broader access than the user themselves. This prevents unauthorized access to personal data.
Communication security
All communication between Joni, the JOIN REST API, and the AI components is TLS-encrypted. No sensitive data is placed in URLs or headers that could leak through logging or monitoring.
Logging and audit trail
Chat questions and AI answers may optionally be logged for audit purposes. A sanitizer removes all personal data before storage. To identify the user in the log, no name is used but an item key, which only a JOIN administrator can trace back to a specific user.
Storage limitation
Personal data temporarily offered to the AI model through RAG is not stored or reused. After answering, this data immediately disappears from the AI model’s memory.
Administration and access
All administration activities related to Joni are restricted to authorized system administrators. Logs with anonymized data are only accessible to a limited number of authorized staff.
With the above setup, privacy risks are low to acceptable because:
This DPIA demonstrates that the use of RAG in Joni complies with the GDPR and the European AI Act. Additional technical and organizational measures have been implemented, such as OAuth-based authentication, encrypted communication, anonymized logging, and strict access control.