You can use artificial intelligence in compliance with GDPR if you control where data is processed, who can access it and what it is used for. In practice that means deploying models in environments the company controls, under contracts that prevent your data from training third-party models, and keeping the personal data that reaches the system to a minimum. It is a question of design, not of tools.
This article summarises technical and organisational criteria. It is not a substitute for advice from your data protection officer.
What GDPR says about artificial intelligence
GDPR does not mention AI explicitly, but it applies to any system that processes personal data. Its principles hold for a spreadsheet and for an AI agent alike:
- Lawfulness and transparency. There must be a lawful basis, and people must know their data is being processed.
- Purpose limitation. Data collected for one purpose is not reused for an incompatible one.
- Data minimisation. Only the data the task needs is processed.
- Integrity and confidentiality. Security measures proportionate to the risk.
- Accountability. The organisation must be able to demonstrate compliance.
Article 22 also protects people from decisions based solely on automated processing that significantly affect them. If an AI system makes decisions about people, there must be meaningful human involvement.
Where your data goes when you use an AI tool
Not every way of using AI offers the same guarantees. The difference lies in who controls the infrastructure and what the contract says.
| Consumer tool | Enterprise cloud service | Deployment in your own cloud | |
|---|---|---|---|
| Where data is processed | Wherever the provider decides | In the contracted region | In your infrastructure, EU region |
| Used to train models | Possible, depending on terms | Can be excluded by contract | No |
| Access control | Personal account | Managed by the company | Integrated with your permissions |
| Suitable for personal data | No | With the right contract | Yes, with the right design |
The consumer tool an employee uses on their own initiative is the biggest risk, precisely because nobody has assessed it. Offering a secure internal alternative is usually the most effective way to prevent it.
Five measures to keep data inside the company
- Deploy in your infrastructure. The system runs in the cloud or servers the company already controls, in EU regions. Models are consumed in private environments, not open services.
- Data processing agreement. Article 28 of GDPR requires a contract with every provider that processes data on the company’s behalf. It should explicitly exclude the use of your data to train models.
- Minimise and pseudonymise. If the agent does not need a customer’s name to triage a ticket, it should not receive it. Data is reduced or replaced with identifiers before it reaches the model.
- Inherit permissions. The system shows each user only what that user could already see. An internal assistant must never become a back door into board documents.
- Log and trace. Every query, every source used and every answer is recorded. That makes the system auditable and lets you respond to data subject requests.
None of these measures slows the project down. They are decided at design stage and tested before every release, like any other requirement.
When a data protection impact assessment is needed
Article 35 of GDPR requires a data protection impact assessment when processing is likely to result in a high risk to people’s rights. Common triggers include:
- Profiling with significant effects on individuals.
- Automated decisions about customers, employees or candidates.
- Large-scale processing of special categories of data, such as health data.
- Systematic use of new technologies on personal data.
Many corporate uses of AI, such as searching technical documentation or extracting data from supplier invoices, carry low risk. Even so, it is wise to document the assessment and have your data protection officer review it.
What the EU AI Act adds
The EU AI Act classifies systems by risk level and sets obligations for each level. It prohibits certain practices, regulates high-risk systems in detail and requires transparency for others, such as telling people they are interacting with an AI.
For most internal uses, such as knowledge assistants or document data extraction, the obligations concern transparency and proper use. Other uses, such as recruitment and candidate screening systems, are considered high risk and require additional controls. That is why each use case should be classified before deployment.
What to ask a provider before you start
Before sending a single record, ask for written answers to these questions:
- In which region is the data processed and stored?
- Is my data, or my users’ data, used to train models?
- Who can access the data, and how is that access logged?
- Which sub-processors are involved, and where are they based?
- How is data deleted when the relationship ends?
- Who owns the system’s code, configuration and documentation?
If any answer is vague, treat it as a no.
How to inform employees and customers
Transparency is an obligation and also a way to build trust. Three fronts are worth covering:
- Privacy notices. If an AI system processes customer or employee data, your privacy policy should explain it: which data, for what purpose and on what lawful basis.
- Notices at the point of use. Anyone talking to an assistant should know it is an automated system and how to ask for a person.
- Internal usage rules. Which tools are approved, what data may be entered and whom to ask when in doubt.
A clear internal policy, paired with an approved tool that works well, removes more risk than any ban.
How we approach it at Neji
We adapt to each company’s technology and security policy. If you need it, we install everything on your servers or in your cloud, and your data stays in-house, under your rules. If you prefer, we host, operate and monitor the solution ourselves, under the data processing agreement GDPR requires. Either way, we apply least-privilege access, full logging and models that do not train on your data. You can see the detail on our security page.
Where to start
Take an inventory of the AI tools already in use in your organisation, official or not. Then choose a first use case with low risk and high volume. If you would like to review it with us, request a first conversation to get to know your company and see where we can help. You can also read how we design AI agents that work with your own data.