AI and GDPR: how to keep your privacy in order

When does the GDPR apply to AI?

The GDPR is about personal data: anything that can identify someone directly or indirectly. Think of a name, email address, phone number or customer number, but also a chatbot conversation or an invoice with an address on it. As soon as data like this ends up in an AI tool, you're processing personal data. Then the rules apply.

That happens sooner than you think. A few examples:

• You paste a customer email with a name and address into ChatGPT to have a reply written.
• A chatbot on your website asks visitors for their name and phone number.
• A tool reads invoices or CVs and puts the data into your system.
• You have AI summarise a recorded call with a customer.

The key GDPR rules for AI at a glance

You don't need to be a lawyer to grasp the basics. These GDPR principles matter most for AI:

• Lawful basis: you need a valid reason to process data, such as performing a contract or consent.
• Purpose limitation: you only use data for the purpose you received it for.
• Data minimisation: you don't process more data than necessary.
• Transparency: people know what you do with their data, for example through your privacy statement.
• Security: you protect data against leaks and misuse.
• Rights: people can access their data, have it corrected or have it deleted.

Data minimisation in particular is useful to remember with AI. Does the AI need the customer's name to write a good reply? If not, leave the name out.

Think about people's rights too. If a customer asks to see or delete their data, you also need to know whether that data is in an AI tool, for example in saved chats or uploaded files. So choose tools in which you can find and delete conversations and files yourself. Otherwise you can't handle such a request properly.

GDPR and ChatGPT: where does your data go?

Many AI services run on servers of large American companies. Data can then end up outside the European Union. That isn't allowed without safeguards. You must be able to show that appropriate arrangements are in place. That's why large providers often offer business plans with contractual terms, and sometimes the option to have data processed in Europe.

A second question: does the provider use your input to train its model? With many free and personal accounts this can be the case, unless you switch it off. With business plans, providers usually state that they don't do this by default. Read the terms carefully. More tips for everyday use are in our article using ChatGPT for business.

Data processing agreement and DPIA: what are they?

If you have an outside party process personal data for your business, that party is a processor. With a processor you sign a data processing agreement. It sets out what the provider may do with the data, how it secures it and what happens in the event of a data breach. Large AI providers often have a standard agreement for business customers.

A DPIA (data protection impact assessment) is a risk analysis you carry out in advance if processing could pose a high risk to people. With AI this can apply, for example, if you process sensitive data such as health information, or if AI makes decisions about people. Whether a DPIA is mandatory in your case is best checked by a specialist.

Checklist: using AI safely with personal data

Want to use AI in your business? Go through this list before you start:

• Write down which data the AI tool receives and why it's needed.
• Remove names and other identifying details wherever you can.
• Choose a business plan with a data processing agreement.
• Check where the data is stored and whether it's used for training.
• Set how long conversations and files are kept.
• Mention your use of AI in your privacy statement.
• Don't let AI make important decisions about people without human review.
• Agree with your team which data must never go into an AI tool.

Using a chatbot on your website? Make sure visitors can see they're talking to a bot and what happens to their data. Also read our piece on a chatbot on your website.

Common AI and privacy mistakes

• Staff use their own free accounts for work, without anyone knowing.
• An entire customer list is pasted into an AI tool 'for a quick analysis'.
• The privacy statement is years old and doesn't mention a single AI tool.
• Nobody knows how long the data stays with the provider.
• A tool is connected to your inbox or CRM without you knowing which permissions it gets.

Besides the GDPR, there has also been the European AI Act since 2024. It isn't about privacy, but about the risks of AI itself. Both laws apply side by side. Our article on the EU AI Act for small businesses explains what it means for you.

How we approach AI and privacy at Violexa

When we build an AI solution at Violexa, we start with the question of which data is really needed. Often it can be done with less than you think. We choose tools that offer business terms, limit what the AI gets to see and make sure a person reviews important steps. We don't give legal advice, but we help you design a setup that's easy to have reviewed. Read more about our approach under AI & automation. A custom solution starts from €1,799 excl. VAT (€2,177 incl. VAT), one-off.

Want to know whether your AI idea can be done in a privacy-friendly way? Book a free quickscan. In 30 minutes, online or on site, we discuss your plan. Afterwards you get short written advice with a price estimate, with no obligation.

Frequently asked questions