GDPR and AI

How it works

The GDPR does not look at the technology but at whether personal data is processed. If you enter names, email addresses or customer data into an AI tool, the usual rules apply: you need a legal basis, have to inform the people concerned and use data sparingly. If you use a provider, a data processing agreement (DPA) is usually required.

A practical example

A support chatbot is supposed to answer customer requests. Beforehand you clarify: Which data goes to the model? Where is it processed? Is it trained on the inputs? Is there a DPA in place?

What you should know

• Choose providers that offer processing in the EU and rule out using your inputs for training.
• Use personal data sparingly or remove it beforehand.
• For particularly sensitive data, consider a local model or your own hosting.
• Give employees clear rules for using AI tools.
• When in doubt: involve your data protection officer or legal counsel.