GDPR and AI in Your Company — What You Need to Know Before Deployment [2026]
GDPR and AI in business. What data can be processed, how to reduce risk, and is ChatGPT GDPR-compliant?
GDPR and AI in Your Company — What You Need to Know
Imagine this scenario: your customer service department deploys an AI chatbot that answers client queries 24/7. The chatbot processes first names, order histories, and conversation content. Do you have a legal basis for this processing? Have you informed customers that they are talking to AI? Is the data being sent to servers outside the EU?
These are not theoretical questions — they are questions that the data protection supervisory authority can demand answers to. GDPR fines reach 4% of annual global turnover or €20 million (whichever is higher). In 2025 the UK’s ICO and European supervisory authorities imposed a growing number of fines on organisations, with AI being a factor in an increasing number of cases.
The good news: GDPR-compliant AI is achievable. It requires deliberate design, not accidental deployment.
Why GDPR and AI Are a Complex Relationship
GDPR was enacted in 2018 — long before the era of generative AI. Its principles were designed with traditional databases and relational processing systems in mind. Generative AI introduces several phenomena that do not fit easily within that framework.
Problem 1 — Unpredictability of processing. A traditional system processes data in a defined, auditable way. An AI model processes data in a way whose precise operation cannot be fully explained. GDPR’s “accountability” principle requires that a controller know what it does with data — with black-box models this is a challenge.
Problem 2 — Training data. Large language models (LLMs) like GPT-4, Claude, or Gemini were trained on vast datasets from the internet. Some of this data may have contained personal information without the knowledge or consent of the data subjects. European supervisory authorities (Italy’s Garante, Ireland’s DPC) have opened proceedings in precisely this context.
Problem 3 — Data migration outside the EU. Most AI model providers are US companies. Transferring personal data to the US requires appropriate legal mechanisms (standard contractual clauses, EU-US Data Privacy Framework). Without them — you violate GDPR with every query containing personal data.
Problem 4 — Automated decision-making. Art. 22 GDPR governs situations where a decision affecting a person is taken solely automatically and produces legal or similarly significant effects. Examples: AI rejecting a credit application, AI screening CVs, AI qualifying insurance. Such systems require specific protective measures.
What Data Does AI Process and Why Does It Matter?
The key to GDPR compliance is understanding what data you are actually processing in AI systems. This is not obvious — personal data can appear where you least expect it.
Typical categories of personal data in corporate AI systems:
- Customer contact data — first name, surname, email, phone number in chatbot conversation content
- Behavioural data — click history, purchase journeys, content of search queries
- Employee data — recruitment interview assessments, productivity analysis results, email content
- Conversation content — chatbot conversations often contain sensitive data (health issues from a pharmacy’s customers, financial data from banking clients)
- Biometric data — if AI analyses video recordings or voice (e.g. a voicebot)
Special category data (Art. 9 GDPR) — health data, political opinions, sexual orientation, racial origin — is subject to special protection and requires explicit consent or another specific legal basis. Processing it in AI without analysis is a serious risk.
The data minimisation principle (Art. 5(1)(c) GDPR) says: collect only what is necessary for the purpose. In practice: do not paste entire customer databases into AI prompts when you only need general patterns. Anonymise or pseudonymise data before AI processing wherever possible.
ChatGPT and GDPR — Can You Use It at Work?
This is one of the most frequently asked questions by company boards. The answer depends on how you use the tool and which version/plan you have chosen.
ChatGPT Free and ChatGPT Plus (individual accounts) OpenAI’s terms of service reserve the right to use data entered by users to improve models (unless the user disables this in settings). It is not recommended to enter personal data of customers, employees, or business partners under these plans. The absence of a Data Processing Agreement (DPA) means there are no legal guarantees of data processing.
ChatGPT Team and ChatGPT Enterprise OpenAI offers a DPA, guarantees that conversation data is not used for model training, and provides a higher level of security. These are plans that can be GDPR-compliant — provided they are correctly configured and used consciously.
ChatGPT Enterprise Additionally offers: data processed in dedicated infrastructure, option to choose region (US or EU — this matters!), advanced logging and audit, SSO and user management.
Summary for the board:
| Plan | DPA available | Data for training | Recommendation |
|---|---|---|---|
| Free / Plus (individual) | No | Yes by default | General use only, zero personal data |
| ChatGPT Team | Yes | No (contractual guarantee) | Possible with data minimisation principles |
| ChatGPT Enterprise | Yes + advanced options | No | Suitable for larger companies with client data |
| OpenAI API (own integration) | Yes | No (API data does not train the model) | Recommended for system integrations |
A similar distinction applies to Claude (Anthropic) — the Claude for Business/Enterprise plan has a DPA; the Free/Pro plan does not. Always check the current terms with the provider before deployment.
Customer Chatbot and GDPR — Obligations
Deploying a customer service chatbot entails a series of specific GDPR obligations. Below are the most important ones.
1. Information obligation (Art. 13 GDPR) Customers must know: who processes their data (the controller), for what purpose, on what legal basis, for how long, and what rights they have. If the chatbot collects personal data (name, email address, conversation content), the information about data processing must be presented before or at the start of the conversation. It should be comprehensible and specific — not a multi-page set of terms and conditions.
2. Legal basis for processing Processing of data in a chatbot must have a legal basis (Art. 6 GDPR):
- Contract — if the chatbot assists in executing an order or a contract
- Legitimate interest — if the chatbot serves customers in a capacity directly related to the services provided (requires a balancing test)
- Consent — for marketing activities or collecting non-mandatory data
3. Obligation to disclose automation (Art. 22 GDPR) If the chatbot makes decisions with legal consequences for the customer (e.g. refusal of service, granting a discount, qualifying for a programme) — the customer has the right to request human intervention and to contest the decision. You must make this possible.
4. Record of processing activities (Art. 30 GDPR) A chatbot = a new processing activity. It must be entered in the record: purpose, categories of data, recipients, retention period, security measures.
5. Data Protection Impact Assessment (DPIA, Art. 35 GDPR) If the chatbot processes data at a large scale or processes special category data — a formal risk assessment (DPIA) is required. It is worth carrying one out pre-emptively, even when not strictly mandatory — the document is evidence of due diligence in the event of a supervisory authority inspection.
How to Deploy AI in a GDPR-Compliant Way: Checklist
The following checklist covers the key steps that boards and COOs should go through before launching any AI system that processes personal data:
Planning phase:
- Identify all categories of personal data the AI system will process
- Define the purpose of processing and the legal basis (Art. 6 GDPR)
- Check whether data can be anonymised or pseudonymised before use in AI
- Assess whether a DPIA is required (special category data, large scale, profiling)
Selecting a provider:
- Does the AI provider have a DPA (Data Processing Agreement)?
- Where is data physically processed — EU, or outside EU?
- If outside the EU — is there an appropriate transfer mechanism (SCC, EU-US DPF)?
- Is the provider certified (ISO 27001, SOC 2)?
- Is data used for model training — and how can this be disabled?
Documentation:
- Entry in the record of processing activities (RoPA)
- Privacy policy updated with AI information
- Information notices for system users (customers, employees)
- Data processing agreement with the AI provider
Implementation:
- Mechanism for exercising data subject rights (access, erasure, objection)
- Escalation procedure to a human for automated decisions
- Data retention — automatic deletion after a defined period
- Logs and audit trail of AI system operation
Post-deployment:
- Regular compliance reviews (every 6–12 months)
- Training for employees using AI
- Data breach reporting procedure (Art. 33 GDPR — 72h to report to the supervisory authority)
AI Act 2025 — New Rules for European Companies
In addition to GDPR, the AI Act — the world’s first comprehensive AI regulation — has been in force since 2025. For companies deploying AI in Europe, it brings new obligations that come into effect in phases.
Risk classification system:
The AI Act divides AI systems into four risk categories:
- Unacceptable risk — banned from 2 February 2025. Includes: social scoring systems, subliminal manipulation, mass biometric surveillance. Generally do not affect B2B companies.
- High risk — AI systems in recruitment (CV screening, candidate scoring), management of access to financial services, educational systems, critical infrastructure. Requirements: registration in EU database, technical documentation, risk management, logs, human oversight, pre-deployment testing.
- Limited risk — chatbots interacting with people. Requirement: disclosure that the user is talking to AI (obligation from 2 August 2026).
- Minimal risk — spam filters, content recommendations, AI for games. No additional obligations.
What this means for your company in practice:
If you use AI for recruitment — you have high-risk obligations. If you deploy a customer chatbot — you must disclose that it is AI. If you use generative AI to create content — an obligation to label AI-generated content (in certain contexts).
The AI Act imposes obligations on “deployers” (companies deploying AI) — meaning you, not just the technology providers. Ignoring the rules carries fines of up to 3% of annual global turnover.
Deploying AI in a way that complies with both GDPR and the AI Act requires a planned approach. This is not a reason to put AI off — it is a reason to do it properly from the start.
FAQ
Must I inform customers that the chatbot is AI?
Yes — from 2 August 2026 this is a statutory obligation under the AI Act. The user must be informed at the start of the interaction that they are talking to an AI system, unless this is obvious from the context. We recommend implementing this obligation now — it is good practice for building trust and requires no additional costs.
What penalties does a company face for using ChatGPT without a DPA to process client data?
The absence of a DPA with the provider means processing data without a proper data processing agreement — a violation of Art. 28 GDPR. A fine can reach €10 million or 2% of annual turnover (whichever is higher). In practice supervisory authorities impose fines proportionate to the scale of the violation and the goodwill demonstrated by the entity. Risk increases if an incident occurs or a client complaint is filed.
Does GDPR prohibit using AI for recruitment?
It does not prohibit it, but it imposes restrictions. Automated CV screening, candidate scoring, and any decisions based solely on AI are subject to Art. 22 GDPR — the candidate has the right to human intervention, an explanation of the decision, and the right to object. The AI Act additionally classifies recruitment AI systems as high-risk, imposing registration and documentation obligations. In practice: AI can assist recruitment, but the decision to reject or invite a candidate should be confirmed by a human.
Can employee data be processed through AI without their consent?
Employee consent as a legal basis for AI data processing is problematic — due to the power imbalance in the employment relationship, employee consent is rarely “freely given” within the meaning of GDPR. A better basis is the employer’s legitimate interest or performance of a contract — but this requires a balancing test and does not cover purposes the employee could not reasonably expect (e.g. sentiment analysis of emails).
How long can chatbot conversation data be stored?
GDPR requires limiting data storage to the time necessary to fulfil the purpose (storage limitation principle, Art. 5(1)(e) GDPR). For a customer service chatbot, typical periods are: transactional data — up to 5 years (tax requirements); conversation logs without transactions — 3–12 months. Each retention period should be justified by purpose and entered in the RoPA and privacy policy.
AI Deployment in Compliance with GDPR — Do It Right From the Start
GDPR and AI errors are costly — not just financially, but reputationally. Customers and business partners increasingly ask how companies protect data in AI systems. Compliance is becoming a competitive advantage, not merely a legal requirement.
The QA10 Process Intelligence Audit (AiP Audit) includes an analysis of planned AI deployments against GDPR and AI Act requirements. Within the audit we:
- identify which AI processes require particular legal attention,
- map the gap between the current state and compliance requirements,
- recommend specific actions with priorities and a timeline.
No fear of regulations — with the awareness that proper preparation means less risk and more space for fast action.