AI and Data Protection: How to Use AI in Your Business in Line with the GDPR

You can use AI in your business in line with the GDPR if you get four things right: a legal basis for every processing of personal data, a data processing agreement with the provider, a sound solution for transfers outside the EU and clear rules for your team. The biggest problems arise where staff copy customer or HR data into private accounts of ChatGPT and similar tools. Business and enterprise versions with the right contracts and settings solve many of these issues.

This article shows when the GDPR applies to AI, what to look for in contracts, hosting and transparency, and how it all fits together with the EU AI Act. At the end you will find a checklist and typical cases from practice. Status: October 2026. This is an overview and does not replace legal advice.

When is personal data involved?

The General Data Protection Regulation (GDPR) applies whenever personal data is processed. That means any information relating to an identified or identifiable person. With AI, this happens more often than you might think:

• An employee has ChatGPT answer a customer complaint that includes a name and order number.
• An AI agent reads incoming invoices with contact names, addresses and bank details.
• A chatbot on your website stores visitors' questions and email addresses.
• A tool transcribes a Teams meeting and summarises who said what.

There is no personal data involved if you only give AI general content, for example for a blog draft, a product description or an Excel formula. For tasks like that, data protection is hardly an issue. As soon as names, contact details, customer numbers, health data or information about employees come into play, all GDPR obligations apply. Keep in mind, too, that many services store inputs and some use them to train their models.

The legal basis: nothing works without it

Every processing step involving personal data needs a legal basis under Article 6 GDPR. The German data protection conference (DSK) makes this point in its guidance on AI and data protection. For companies, three bases are most relevant:

• Performance of a contract (Art. 6(1)(b)): An AI agent processes an order or answers a customer request that is part of fulfilling a contract.
• Legitimate interests (Art. 6(1)(f)): You use AI to make internal processes more efficient, and the interests of the people affected do not override yours. This requires a documented balancing test.
• Consent (Art. 6(1)(a)): It must be freely given, informed and revocable. In employment relationships, it is often difficult because of the dependency involved.

Special categories such as health data are subject to stricter rules under Article 9 GDPR. And under Article 22 GDPR, decisions with legal effect must generally not be made by a machine alone. The DSK gives the example of an AI that evaluates job applications on its own and sends out interview invitations by itself. A human must actually make the decision, not just rubber-stamp it.

Data processing agreement with the AI provider

If you use an external provider's AI tool for your own purposes, the provider is usually your processor. You then need a data processing agreement (DPA) under Article 28 GDPR. Among other things, it states that the provider only processes data on your instructions, which security measures apply and which sub-processors are involved.

Consumer versions of AI tools usually come without a DPA. For business and enterprise versions, the major providers offer one. OpenAI, for example, provides a Data Processing Addendum for ChatGPT Business, Enterprise and the API (OpenAI). For every tool, check that the agreement has actually been signed, not just offered.

International transfers, EU hosting and the Data Privacy Framework

Many AI providers are based in the US. Transfers there fall under Articles 44 et seq. GDPR. There are three common routes:

1. EU-US Data Privacy Framework (DPF): Since July 2023, there has been a Commission adequacy decision for US companies certified under the DPF. The EU General Court upheld it in September 2025 (Latombe case). An appeal against that judgment is pending at the Court of Justice (C-703/25 P). The decision applies until a court rules otherwise. Another strike-down, as happened with the previous frameworks, cannot be ruled out entirely.
2. Standard contractual clauses: The classic route when the recipient is not certified, and often included in the DPA as well.
3. EU hosting: Data is stored and processed in the EU. OpenAI offers this for ChatGPT Enterprise, Edu and the API, for example, and Microsoft for its cloud services including Copilot through the EU Data Boundary. Check which exceptions apply, for example at peak load, for individual AI models or for support access.

In practice: for sensitive data, a tool with EU hosting and a DPA is the safest choice. For less critical uses, a DPF-certified provider with a DPA can be enough. You can check whether a US provider is certified on the official list at dataprivacyframework.gov.

Data protection impact assessment (DPIA)

If processing is likely to result in a high risk to people's rights, a data protection impact assessment under Article 35 GDPR is mandatory beforehand. The DSK states in its guidance that this will often be the case when AI applications are used. Typical triggers are evaluating people, processing employee data on a large scale, sensitive data or new technologies with unclear consequences.

For the DPIA, you need information from the provider about how the system works. So make sure the provider supplies it when you choose a tool. For simple applications such as a writing assistant without personal data, a documented screening that explains why no DPIA is needed is often enough.

Transparency and data subject rights

If you process personal data with AI, you must inform the people concerned (Articles 13 and 14 GDPR). In practice: update your privacy notice and your information for employees, name the tools and purposes, and explain the logic of automated decisions in plain language.

Data subject rights apply to AI in full: access, rectification, erasure and objection (Articles 15 to 21 GDPR). The DSK points out that AI output can contain false information about people. So you need a process for handling such requests for data in AI systems too. Since 2 August 2026, Article 50 of the AI Act also applies: people must generally be able to tell that they are interacting with an AI system, for example a chatbot.

Consumer tools vs. business and enterprise versions

Often the biggest lever for data protection is choosing the right version. The DSK explicitly recommends giving employees company accounts instead of letting them work with private ones.

	Consumer version (free or Plus)	Business or enterprise version
Training on your inputs	often possible by default, opt-out needed	excluded by default, according to providers
Data processing agreement	usually not available	usually available
Data storage in the EU	usually not selectable	partly selectable (e.g. Enterprise)
Managed by IT	no	central accounts, permissions, retention
Suitable for customer data	no	with contract and rules: yes

Which solution fits your company depends heavily on your IT landscape. You will find a detailed comparison in Copilot vs. ChatGPT Enterprise.

How it fits with the EU AI Act

The GDPR and the AI Act apply side by side. The GDPR protects personal data, the AI Act regulates AI systems according to their risk. For most companies, three points from the AI Act matter:

• AI literacy (Article 4): Since 2 February 2025, companies must take measures so their team uses AI safely. Our article on the AI literacy obligation explains how.
• Transparency (Article 50): Since 2 August 2026, labelling and information duties apply, for example for chatbots and AI-generated content.
• High-risk AI: For example AI used to select job applicants. After the Digital Omnibus, these obligations apply from 2 December 2027.

The GDPR itself may change as well. In November 2025, the Commission proposed amendments as part of the "Digital Omnibus", including on using data for AI. Unlike the AI part, this data protection part has not been adopted as of early October 2026. Until it is, the GDPR applies unchanged. For copyright questions around AI content, read our article on AI and copyright.

Typical cases: risk and measures

Case	Risk	Measures
ChatGPT in the team with private accounts	high: customer data reaches the provider without a contract, possibly used for training	Business version with DPA, training off, AI policy with clear no-gos
ChatGPT or Copilot with a business licence	medium: data may leave the EU, usage often unregulated	check the DPA, EU hosting where possible, training and policy
AI agent for invoices	medium: contact details and bank data are processed	document the legal basis, DPA, human approval, log every step
Chatbot on your website	medium: visitor inputs, possibly sensitive details	AI disclosure, update the privacy notice, answers only from approved knowledge, retention limits
Meeting transcription	medium to high: employee data, recorded conversations	inform all participants, involve the works council, limit storage
AI pre-screening of applications	high: Article 22 GDPR, high-risk under the AI Act in future	DPIA, a human decides, transparency towards applicants

Checklist: introducing AI in line with the GDPR

1. Take stock: Which AI tools is your team already using, including unofficially?
2. Define the purpose: What is each tool used for, and is personal data involved?
3. Document the legal basis: For every processing with personal data, with a balancing test for legitimate interests.
4. Involve your data protection officer: Early, not just before launch. For employee data, involve the works council too.
5. Choose the right version: Company accounts in business or enterprise versions instead of private accounts.
6. Sign a DPA: And check the sub-processors.
7. Sort out international transfers: EU hosting, DPF certification or standard contractual clauses.
8. Use privacy-friendly settings: Turn off training on inputs, limit chat history, assign access rights.
9. Check whether a DPIA is needed: Document the screening and run a full DPIA if the risk is high.
10. Be transparent: Update your privacy notice and employee information, label AI chatbots.
11. Write an AI policy: Approved tools, prohibited data, duty to check results, contact person.
12. Train your team: So the rules work in practice and the Article 4 AI Act obligation is met.

If you develop or run AI systems yourself, two further DSK papers are useful: on technical and organisational measures (June 2025) and on AI systems using RAG (October 2025). Both are linked on the DSK's guidance overview (in German).

How aiworx builds projects with data protection in mind

We build AI agents that take on tasks such as invoice processing as digital colleagues. With our AI automation, a human approves wherever you want, and every step is logged. That keeps it traceable what the agent did with which data, which helps with access requests and with documentation for your data protection officer.

For AI customer service, we use our own product pingo. pingo only answers from knowledge you have approved. That reduces the risk of the AI giving false information or revealing content it should not.

And because data protection in daily work depends mostly on people, we also cover safe handling of company data in our workshops and training, including AI policies and the obligations under the EU AI Act. Our tip: bring your data protection officer to the table from day one.

Frequently asked questions

Can I use ChatGPT in my company in line with the GDPR? Yes, if you use a business or enterprise version with a DPA, training on your inputs is excluded and there are clear rules on which data may be entered. Private accounts, on the other hand, are hardly workable for customer data under the GDPR.

Do I need a DPA for every AI tool? Whenever the provider processes personal data on your behalf. If you only use a tool with content that contains no personal data, no DPA is needed. In practice, though, that is rarely certain.

Is a DPIA always required for AI? Not always, but often. It is required when a high risk to the people affected is likely. The DSK assumes that this will often be the case with AI. Either way, document your screening.

Is the EU-US Data Privacy Framework still valid? Yes. The EU General Court upheld the adequacy decision in September 2025. An appeal is pending at the Court of Justice, so keep an eye on developments and prefer EU hosting for sensitive data.

What are the penalties for GDPR violations? Fines under Article 83 GDPR of up to €20 million or 4 percent of worldwide annual turnover, plus damages claims from the people affected. The amount depends on severity and fault.

Does the EU AI Act replace the GDPR for AI? No. Both apply side by side. The GDPR governs how personal data is handled, the AI Act sets duties around AI systems such as AI literacy, transparency and high-risk applications.

Want to use AI and get data protection right from the start? Let's talk about your plans in a free initial call.