Using AI in your business in a GDPR-compliant way

Short answer: Using AI in your business in a GDPR-compliant way mainly means clarifying three things up front: which personal data goes into the system, where it is processed, and whether there is a data processing agreement with the vendor. On top of that comes the question of which obligations the EU AI Act brings for your use. This is general information and not legal advice. For your specific case, involve a data protection officer or a lawyer.

Why this question comes up so often

Anyone who introduces AI into a business quickly ends up with customer data: emails, quotes, minutes, employee data. As soon as these contain names, addresses or other details about people, the GDPR applies. That is no reason to skip AI, but it is a reason to think through the setup before the start instead of afterwards.

Step 1: Know which data you process

Make a simple list for the process you want to support with AI. What data goes in? Is it personal data, and which? Is anything particularly sensitive in there, such as health information? Many processes can be cut so that less personal data is needed, for example by removing names before processing. What never lands in the system does not need to be protected later.

Step 2: Clarify data processing

If you use an AI model or tool from a vendor, that vendor processes data on your behalf. This usually requires a data processing agreement. For each vendor, check:

• Is there such an agreement, and does it cover exactly the product you use?
• Where is the data processed, inside the EU or outside?
• Are your inputs used to train models, and can that be switched off?
• How long are histories stored, and can you delete them?

You find the answers in the vendor's contract documents. Do not rely on marketing copy.

Step 3: Choose where processing happens

For data protection it makes a big difference whether a model runs at a vendor or on your own hardware. A locally run model never leaves your premises, but it costs setup and hardware and, depending on the task, is less capable than large vendor models. In between sits hosting in the EU. Which level fits depends on how sensitive the data is and how good the answers must be. This is exactly the decision I make with clients before the build, not after.

Step 4: Keep a person in the loop

An AI can be wrong and make up answers. That is why every point where something goes outside or a decision about people is made needs a human approval. This protects against mistakes and makes your process traceable: who approved what and when, and which source stood behind it? A log of every run helps you answer requests for information.

Step 5: Keep the EU AI Act in view

The EU AI Act regulates AI systems by their risk. For many everyday uses in mid-sized businesses, such as email drafts or knowledge search, the requirements are manageable, for example transparency toward people who talk to an AI. It gets stricter for applications that decide about people, for instance in HR. Whether your case belongs there is something to sort out with qualified advice.

A simple checklist to start

• Process and data types written down
• Data processing agreement in place with every vendor
• Processing location chosen deliberately
• Training on your inputs excluded or clarified
• Human approval at every point with an effect outside
• Staff know which tools they may use and which not
• Data protection officer or lawyer has seen the setup

How I handle it

I start AI projects with a risk analysis: which data, which vendor, which location, which approvals. A prototype with a right to cancel follows. The roadmap AI for business shows the frame, and how agents are built with permissions and approvals is on the page about AI agents. I do not provide legal advice. I build so that your advisor has something verifiable in front of them.

If you want to know what this could look like for your business, book the free 15-minute first call. You get an honest assessment, without obligation.