How can you use AI in a company in a GDPR-compliant way?

AI and data protection in business: what the law is about

The General Data Protection Regulation (GDPR) applies whenever AI is used to process personal data – that is, information that can be related to a person. This affects not only customer databases but also prompts containing names, uploaded emails, contracts, meeting notes, or job application documents. Each of these processing activities needs a legal basis under Art. 6 GDPR.

The GDPR principles apply as well: purpose limitation, data minimization, accuracy, storage limitation, and security of processing. For AI, that means, for example, entering only the data needed for the task and checking results about people for accuracy. The German data protection supervisory authorities have published guidance on AI for this purpose through the German Data Protection Conference (DSK).

ChatGPT for business and the GDPR: vetting the provider properly

Companies that use ChatGPT or other AI assistants generally make the provider a data processor. A data processing agreement under Art. 28 GDPR is then required, which many providers make available for their Business and Enterprise plans. With free or private access it is often missing – one of the most important reasons to switch to centrally managed business accounts.

Also check whether your inputs are used to train the models, how long data is stored, and where the processing takes place. For providers based in the US, the transfer must be safeguarded, for example through certification under the EU-US Data Privacy Framework or through standard contractual clauses. Some providers now also offer data storage in Europe.

Typical data protection problems when using AI

Most data protection problems with AI arise in everyday work, not in the data center. Employees copy a customer complaint, including names, into a public chat tool, upload a staff list for analysis, or install a browser extension that reads along. Without rules and business accounts, the company often only finds out when something has already gone wrong.

Automated decisions with a significant impact on individuals are particularly sensitive, for example in job applications or credit decisions: Art. 22 GDPR sets narrow limits here. Made-up statements are a data protection issue too when an AI produces false information about real people, because the GDPR requires that processed data be factually accurate and corrected where necessary.

• Private accounts without a data processing agreement
• Personal or confidential data in prompts
• Use of inputs for model training
• Lack of information for the data subjects
• False AI statements about real people
• Automated decisions without human review

Technical measures: how AI becomes privacy-friendly

Many risks can be mitigated technically. If names, addresses, or customer numbers are automatically removed or replaced before being passed to a language model, the risk drops considerably – this pseudonymization is often possible without any loss of quality. With custom integrations via an API, we control exactly which data goes to the model, how long logs are stored, and who has access to them.

For particularly sensitive data, AI models that run in a European cloud or on your own infrastructure come into question. With knowledge bases that use retrieval-augmented generation (RAG), permissions ensure that the AI shows each person only content they would be allowed to see anyway. At Nano Concepts, we implement these measures in AI integration, coordinated with your data protection officer.

Organiza­tional measures: policy, records, training

Technology alone is not enough. An AI policy defines which tools are allowed and which data may go into which tools. Every AI processing of personal data belongs in the record of processing activities under Art. 30 GDPR. The privacy policy has to be adapted if customers or website visitors are affected – for example with a chatbot on the website or AI-assisted analysis of inquiries.

If processing is likely to result in a high risk for the data subjects – for example with extensive analysis of employee or health data – a data protection impact assessment under Art. 35 GDPR must be carried out. AI data protection training for all users rounds off the measures: it explains with specific examples from your daily work what is allowed and makes the policy tangible.

The EU AI Act and other legal foundations in Germany

Alongside the GDPR, the EU AI Act applies. It takes a risk-based approach: certain practices are prohibited, strict requirements apply to high-risk systems – for example in recruitment or credit assessment – and transparency obligations are provided for chatbots and AI-generated content. Companies that use AI are also obliged to ensure AI literacy among their staff.

In Germany, further rules include the Federal Data Protection Act, the TDDDG (the German Telecommunications Digital Services Data Protection Act) for cookies and access to end devices, the Works Constitution Act (BetrVG), and the protection of trade secrets. The state authorities are responsible for data protection supervision of companies. The obligations of the AI Act apply in stages and can be adjusted by the legislator. This overview does not replace legal advice; check the current status with your advisor.