GDPR and AI, before the first prompt
The moment a language model sees customer data or personnel files, what the GDPR asks of you changes. We build AI systems so that your data protection officer and works council can read the log. The result alone will not satisfy either of them.
- GDPR (General Data Protection Regulation)
- The GDPR is Regulation (EU) 2016/679, the General Data Protection Regulation. It applies to any organisation processing personal data in the EU, and it keeps applying unchanged when an AI system takes over the processing. The law stays the same. The path the data takes changes, and that path has to be written down again.
The model is a new recipient. That is the whole difference.
A clerk who summarises customer emails with ChatGPT has, in GDPR terms, just transferred data to a processor in the United States. No contract, no entry in the record, and nobody knows how long it is kept.
That is how it starts in most companies: browser tabs in three departments, long before anyone calls it an AI project. The data protection officer hears about it at the annual review.
The regulation itself has not moved. Legal basis, purpose limitation, processor contracts, data subject rights: all known since May 2018. What is missing is the translation to prompt, log and vector index. That is what we deliver as the technical partner, with your data protection officer at the table. In the knowledge agent project index and search run on EU servers for that reason, and the speech recognition in the meeting project runs on our own hardware.
Six places where the GDPR bites when AI comes in
Each one has an article number and a technical counterpart. We take care of the second half and hand the first half its material.
Legal basis
Before a model sees data, the processing needs a basis under Art. 6: contract, legitimate interest or consent. A new purpose, say summarising instead of handling, needs a fresh check under Art. 5(1)(b).
Data processing agreement
The model provider is a processor. Art. 28 requires a contract with fixed content plus the list of sub-processors. Without it every API call is a transfer with no basis.
Impact assessment
Art. 35 calls for a DPIA where a high risk is likely: employee scoring, applicant screening, large data merges. Where none is needed we record that too, with reasons.
Information
Customers and employees must know that an AI system reads along, for what and for how long. Art. 13 and 14 require this before the first processing, in plain language. We supply the text for the privacy notice.
Data subject rights
Access, rectification, erasure, objection, Art. 15 to 21. Plus Art. 22 where the system decides about people. Technically this means every person must be findable in prompts, logs and index.
Deletion concept
Storage limitation under Art. 5(1)(e) and erasure under Art. 17 also cover embeddings, caches and backups. A deletion job that only reaches the database does not meet them.
Where the data goes, and what that triggers legally
The choice of where the model runs decides the contract, the third country question and the effort. The table shows the four usual routes.
| Where the model runs | Legal basis and contract | Third country transfer | Our recommendation |
|---|---|---|---|
| Cloud API of a US provider | DPA under Art. 28 mandatory, transfer secured under Art. 45 or 46 (adequacy decision or standard contractual clauses) | Yes, Chapter V applies, even with an EU region at the provider | Only with pseudonymised input, training excluded by contract, retention switched off |
| EU provider or EU region | DPA under Art. 28, read the sub-processor list | No, as long as support and backups stay in the EU | Default for customer data, keep a model switch open |
| Own hardware, local model | No processor for the model, record and deletion concept still required | No | For personnel files, health data and anything the works council sees |
| Free accounts in the browser | No DPA possible, consumer terms, training usually on | Yes, uncontrolled | Switch off and replace with a company account under a DPA |
What the code contributes
Art. 25 requires data protection by design, Art. 32 appropriate security. Both are design decisions, not appendices. Four of them are in every system we hand over.
In Germany the works council has a co-determination right under section 87(1) no. 6 of the Works Constitution Act for systems that can capture employee behaviour or performance. We build the log so that it can say yes.
Three steps, six documents
We start with the processing that is already running. That is where a supervisory authority asks first.
Inventory
Which department uses which tool, with which data, under which account. Including the tools nobody ever purchased.
Paperwork
Entry in the record under Art. 30, contract review under Art. 28, DPIA decision with reasons, text for the privacy notice under Art. 13.
Implementation
Pseudonymisation, logging, access model and deletion job in the code. Handover to the data protection officer and the works council with a technical description both can read.
The six documents: record entry, DPIA decision, DPA checklist per provider, deletion concept, technical description, information text for customers and employees. All in a format you can keep up to date yourself six months later.
This page is not legal advice. We deliver technology and paperwork. The legal assessment is made by your data protection officer or your law firm, and we are happy to work with both.
GDPR and EU AI Act: two laws, one register
The EU AI Act looks at the system, the GDPR at the data inside it. An internal chatbot often falls under both.
On one side the labelling duty under Art. 50 of the AI Act, on the other the record, the contract and the retention period. Handle the two laws separately and you inventory the same bot twice.
We keep both in one table. What the AI Act asks of deployers is on the AI transparency page and in the EU AI Act documentation.
GDPR and AI: common questions
Related topics
AI transparency
What Art. 50 of the EU AI Act has required of deployers since August 2026, with deadlines and fines.
EU AI Act documentation
Risk classification, system register and technical description for operation.
RAG systems
Knowledge systems with a source for every answer, EU hosting or your own hardware.
Tell us which department is already using AI today.
Thirty minutes are enough to say whether the record and the contracts need catching up. If they do not, we will say that too.