Why data protection belongs at the start
As soon as an AI processes emails, invoices, job applications or customer enquiries, personal data is almost always involved: names, addresses, contact details, sometimes bank details or health information. That means the General Data Protection Regulation applies, from the very first test run.
The good news: the GDPR does not prohibit the use of AI. It does, however, require you to know which data flows where, on what basis that happens and how you safeguard the rights of the people concerned. Clarifying these questions early saves you rework later.
This article gives an overview of the most important points. It is not legal advice and does not replace consultation with your data protection officer or a law firm.
Establish the legal basis
Every processing of personal data needs a legal basis under Art. 6 GDPR. For most automations in everyday office work, little changes compared with doing the work by hand: if you process an invoice today to fulfil a contract or because of tax obligations, the same applies when a system reads it.
- Performance of a contract, for example when handling orders and enquiries.
- Legal obligation, for example retention requirements in accounting.
- Legitimate interest, for example when pre-sorting an inbox, with a careful balancing of interests.
- Consent, where no other basis fits, for example for certain analyses.
For each use case, check whether the automation changes the purpose of the processing. If you are simply processing data faster, you usually stay within the existing framework. If you analyse data for new purposes, you need a fresh assessment.
Data processing agreement and server location
Processing on your behalf under Art. 28 GDPR
If a service provider processes personal data on your behalf, you need a data processing agreement. It sets out what the provider may do with the data, which technical and organisational measures it takes and which sub-processors are involved, such as the provider of the language model or the data centre. The agreement should be in place before the first processing, not after the test run.
Where the data is processed
Many AI services run on servers outside the EU. Transfers to third countries are not prohibited in principle, but they require additional safeguards and close scrutiny. The assessment is simpler if processing takes place entirely within the EU, ideally in German data centres. So do not just ask where the application runs, but also where the language model does its computing.
No training on your data
A frequently overlooked point: some AI services reserve the right to use inputs to improve their models. For business data this is generally not acceptable, either from a data protection perspective or with regard to trade secrets.
Make sure the contract rules out your content being used to train third-party models. For particularly sensitive data, a model running in your own infrastructure is also an option, so the data never leaves your organisation at all.
Data minimisation and deletion policy
The GDPR requires that only the data needed for the purpose is processed. For an automation, that means the agent gets access to what it needs for its task, not to the entire inbox or the entire database.
- Limit access to the necessary folders, inboxes and fields.
- Adopt the roles and permissions from your existing systems.
- Store intermediate results and logs only for as long as necessary.
- Define and document deletion periods, including for test data.
- Assess special categories such as health data separately.
A deletion policy is part of the setup, not an afterthought. It describes which data is stored where, how long it is kept and how it is deleted. Statutory retention periods, for example in accounting, take precedence.
When a data protection impact assessment is required
Under Art. 35 GDPR, a data protection impact assessment is required if processing is likely to result in a high risk to the rights and freedoms of the people concerned. That can be the case with new technologies, in particular when data is analysed on a large scale, people are evaluated or sensitive data is processed.
For reading incoming invoices, an impact assessment is usually not needed. For pre-screening job applications or rating customers, things look different. Agree the assessment with your data protection officer before the system goes live.
Automated individual decisions and transparency
Art. 22 GDPR
People have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them. In practice, this means decisions such as rejecting a job applicant or turning down a customer should not be made by a system alone.
The simplest way is a human in the loop. The agent prepares the decision, sorts, summarises and gives reasons; the decision itself is made by a person. What matters is that this review is genuine and not just a confirmation without looking at the case.
Inform the people concerned
Your privacy notice should describe that and how AI is used. This applies, for example, to customers writing to an automated customer service or to applicants whose documents are read automatically. Clear information builds trust and at the same time fulfils your transparency obligations.
Conclusion
AI and the GDPR are not mutually exclusive. What matters is that the legal basis, processing on your behalf, server location, deletion policy and human decision-making are settled from the outset. Alongside the GDPR, AI systems are now also subject to the EU AI Act, which brings its own obligations depending on the use case. You should look at both sets of rules together.
This article does not replace legal advice. For a binding assessment of your case, please contact your data protection officer or a law firm.