GDPR and AI: a checklist for businesses

How can you use AI in your business while complying with the General Data Protection Regulation (GDPR)? The GDPR has no dedicated rules for artificial intelligence. Its general obligations apply in full, however, as soon as an AI tool processes personal data – and that happens sooner than many people think: in emails, support requests, CVs, logs or source code containing customer data. This checklist walks you through the most important points: data processing agreements, server location, training on your data, retention periods and documentation.

Important note: this article is general guidance and not legal advice. Whether and how the individual points apply to your project depends on the specific case. Clarify binding questions with your data protection officer or a law firm.

Data processing: the DPA

If an external provider processes personal data on your behalf, it is usually a processor within the meaning of Art. 28 GDPR. This applies to many AI services you use through an interface or a web application. In that case a data processing agreement (DPA) is required.

When reviewing a DPA, look out for these points among others:

• The subject matter, nature and purpose of the processing are described.
• The provider's technical and organisational measures are specified.
• Sub-processors are listed, and you are informed about changes.
• It is clear what happens to the data when the contract ends.

If a provider does not offer a DPA, that is a clear warning sign for any use involving personal data.

Server location and third countries

Where data is processed has a big impact on how much you need to review. If processing takes place in the EU or the European Economic Area, the general GDPR rules apply. If data is transferred to a third country, such as the United States, the requirements of Art. 44 et seq. GDPR apply on top. You then need a sound legal basis, for example an adequacy decision or standard contractual clauses, and depending on the set-up an additional assessment.

So do not just ask where the provider has its headquarters. Ask specifically: in which country do the servers that process my requests run? Where are logs and backups stored? And which sub-processors are located outside the EU?

Training on your data

Many AI providers improve their models with usage data. For you this is delicate: if your inputs are used for training, they leave their original purpose and you lose control over what happens to them. That can conflict with the principle of purpose limitation (Art. 5(1)(b) GDPR) and affects trade secrets as well as personal data.

Check the contract documents and terms of use to see whether inputs and outputs are used for training, whether this is switched off by default or has to be opted out of, and whether the commitment also covers logs. Rely on contractual terms, not on marketing statements.

Retention periods

The GDPR requires that personal data be kept only as long as necessary for the purpose (storage limitation, Art. 5(1)(e) GDPR). For AI tools this means you should know how long inputs, outputs, histories and technical logs are stored by the provider and how you can delete them.

These questions help: is there a fixed retention period for requests? Can you or your users delete histories? How are erasure requests from data subjects under Art. 17 GDPR handled? And what happens to backup copies?

Data minimisation: what belongs in the AI at all?

The simplest data protection is the kind you never need. Under the principle of data minimisation (Art. 5(1)(c) GDPR), only data that is genuinely necessary for the purpose should be processed. For AI tools this means, in practical terms: before each use, consider whether names, addresses, customer numbers or health details are needed for the task at all.

Often a text without personal references is enough. A contract can be summarised just as well when the names of the parties are replaced with placeholders. A bug can be reproduced with test data instead of real customer data. Wherever this is possible, both risk and review effort drop considerably. Ideally, put such rules in writing so everyone on the team knows which data may go into which tool.

Documentation and accountability

Data protection has to be demonstrable (accountability, Art. 5(2) GDPR). For AI tools this typically includes:

• an entry in the record of processing activities (Art. 30 GDPR),
• the legal basis for the processing (Art. 6 GDPR),
• updated privacy notices where data subjects need to be informed about the use of AI (Art. 13 and 14 GDPR),
• where necessary, a data protection impact assessment (Art. 35 GDPR), especially for large-scale processing of sensitive data or new technologies with a high risk,
• internal rules on which data may be entered into which tools.

Also check whether decisions with legal or similarly significant effects are made solely by automated means. Special rules apply to these under Art. 22 GDPR. Alongside the GDPR, the European AI Act is gradually taking effect. Whether and which obligations follow from it for your project should be reviewed separately.

The checklist

• DPA signed with the provider, sub-processors known
• Server location and storage location of logs and backups clarified
• Third-country transfers ruled out or legally secured
• Training on your inputs and outputs excluded by contract
• Retention period known, deletion of histories possible
• Process for erasure requests from data subjects defined
• Entry created in the record of processing activities
• Legal basis documented, privacy notices reviewed
• Need for a data protection impact assessment checked
• Internal rules for using AI tools defined and communicated
• Data protection officer involved

Conclusion

The GDPR does not prohibit the use of AI. It does require that you know where your data goes, what happens to it there and how long it is kept – and that you document this. A provider offering a DPA, processing in the EU and a contractual exclusion of training takes a large part of the review work off your hands. Responsibility for the specific use still lies with you.

To see how we meet these requirements with A2Intelligence – with a DPA under Art. 28 GDPR, processing on our own hardware in Bochum, Germany, and no training on your data – visit our page on GDPR-compliant AI.