AI and GDPR: How to Use Artificial Intelligence with Personal Data Legally
Are you allowed to enter personal data into AI tools? Legal basis, data processing agreements, transfers outside the EU, and practical steps for compliant AI use.
AI and GDPR intersect every time an employee enters a customer's name, email address, CV, or health data into an artificial intelligence tool. The General Data Protection Regulation applies to AI as well — any processing of personal data requires a legal basis, a data processing agreement, and appropriate security measures.
TL;DR — Key Takeaways
- GDPR applies to every entry of personal data into an AI tool.
- You need a Data Processing Agreement (DPA) with the AI provider.
- Pay attention to data transfers outside the EU.
- The AI Act (high risk) also applies to AI in HR processes.
Key Questions Before Using AI with Personal Data
| Question | Why it matters |
|---|---|
| What is the legal basis? | Without it, processing is unlawful |
| Do we have a processing agreement? | The AI provider is a processor under Article 28 |
| Where is the data processed? | Transfers outside the EU require additional safeguards |
| Is the data used for training? | This may be a new, unauthorized purpose |
| Is a Data Protection Impact Assessment (DPIA) required? | Yes, for large-scale or high-risk processing |
Practical Measures
- Use enterprise versions of AI tools with a Data Processing Agreement.
- Choose EU-based processing where available (e.g., Microsoft EU Data Boundary).
- Anonymize or pseudonymize data before entry.
- Update your Record of Processing Activities (ROPA).
- Perform an impact assessment for HR and similar use cases.
- Educate employees with a clear AI company policy.
Frequently Asked Questions
- Can I enter a customer's name into ChatGPT?
- We do not recommend this in the free version without a processing agreement. It may be permissible in an enterprise tool with a DPA and an appropriate legal basis.
- Does Microsoft 365 Copilot comply with GDPR?
- Microsoft offers a processing agreement and the EU Data Boundary, but compliance also depends on your specific usage and settings.
- Who is responsible if AI leaks data?
- The controller, i.e., your company, remains responsible for the lawfulness of the processing.
Related posts
Business Continuity Plan: What a BCP for SMEs Must Include
What do we do if nothing works tomorrow morning? A 10-page BCP is all you need.
IT SupportIT Infrastructure Documentation: What Needs to be Recorded and Why
If it isn't documented, it doesn't exist. The minimum documentation scope every company needs.
CybersecurityTwo-Factor Authentication: Implementation Without Employee Resistance
MFA stops the vast majority of stolen password attacks. Learn how to deploy it quickly and without complaints.