GDPR and AI at work: what to check before you deploy
6 min read
Short answer
If you send a language model anything from which a person can be identified, the provider is a data processor: you need an agreement with them under Article 28, you need to know where the processing happens, and you need an assurance that inputs are not used for training. Those are three questions to ask before deployment, not after.
01What counts as personal data here
Not only a name and address. Also the e-mail you send for processing, the order text with a contact person's name, a call recording, a photo of an invoice with a signature on it.
In practice almost every useful business automation touches personal data. That is not a reason for drama; it is a reason to have it settled.
02Three questions for the provider
The answers belong in a contract, not in a sales deck.
- 01Is there a processor agreement under Article 28 of the GDPR?
- 02Where is the data processed, and if outside the EU, on what legal basis?
- 03Are inputs used to train models, and can that be switched off?
03What helps most and costs least
Not sending what is not needed. A model triaging enquiries does not need national ID or bank account numbers; they can be stripped before the request goes out.
Setting how long anything is kept — at the provider and at your end. A log holding the full text of every e-mail that nobody ever deletes is a bigger risk than the model.
Writing down who has access. That is also the first thing an audit asks for.
04Decisions a model must not make alone
The GDPR restricts automated decisions producing legal effects or similarly significant ones. In practice: rejecting an application, ending a contract, evaluating an employee, assessing creditworthiness.
The answer is not to avoid these areas. It is to let the model prepare the material and leave the decision to a person who can change it and explain why.
05What to write down even if nobody asks
One page: what AI is used for, what data goes into it, who the provider is, how long things are kept, and who approved it.
That page is the difference between an hour's conversation and months of investigation. And if your supplier cannot help you write it, that is information in itself.
Frequently asked
- Do we need a processor agreement with an AI provider?
- Yes, if you send the model data from which a person can be identified. The provider is then a processor under Article 28 of the GDPR.
- Can AI decide about employees or clients on its own?
- Not for decisions with legal or similarly significant effects. The model may prepare the material; a person who can change and explain the decision has to make it.
- What is the cheapest way to reduce risk when deploying AI?
- Send only the data the task needs, limit how long logs are kept, and write down who has access to what.