AI and GDPR: what can you do with customer data?

"Are we even allowed to do that, with our customer data?" The question comes up in almost every conversation about AI, and rightly so. Many SMEs hold back on AI projects because they're unsure about GDPR. Others are already using ChatGPT heavily, without really knowing what happens to their data.

The good news: AI and GDPR go together fine, as long as you follow a few basic rules. We lay them out in this article.

This article is a practical overview, not legal advice. If you're unsure about your specific situation, check with your DPO or a lawyer.

The core: GDPR doesn't change because of AI

GDPR applies to every processing of personal data, whether that happens in Excel, in your CRM or in an AI model. The questions stay the same:

• Do you have a legal basis? For example, performing a contract or a legitimate interest.
• Do you only use the data you need? That's data minimisation.
• Do you know where the data ends up and who can access it?
• Can you show that you're doing it right?

AI mainly makes the third question harder, because an AI service is almost always a third party.

The biggest risk: free consumer tools

The most common problem isn't in large AI projects, but in employees pasting customer data into a free chatbot. With consumer versions of AI tools, the provider can often use your input to improve its models, and there's no data processing agreement.

What to do about it:

• Use business versions of AI services, where the provider commits contractually not to use your data for training.
• Write a short AI policy for your team: which tools are allowed, and which data must never go into them.
• Offer a good alternative. People reach for free tools because they want to solve a problem. An internal AI assistant that is secure removes that reflex.

Five questions for every AI vendor

Before you adopt an AI solution, or have one built, ask these questions:

1. Is there a data processing agreement (DPA)? It's mandatory when a third party processes personal data on your behalf.
2. Where is the data stored and processed? Preferably within the EU. If it's outside, valid transfer mechanisms must be in place.
3. Is your data used to train models? The answer should be "no", and it should be in the contract.
4. How long is data kept? And can you have it deleted?
5. Who has access? Inside your own organisation too: an AI assistant shouldn't show HR or financial data to everyone.

Building privacy in from the start

With a custom AI solution you have more control than with an off-the-shelf tool. A few principles we apply ourselves:

• Respect permissions. An AI assistant only shows information the user was already allowed to see without AI.
• Minimise data. Only send an AI model what the task requires. Names or national ID numbers can often be left out or replaced.
• An audit trail. Record what an agent did and based on which data, so you can account for it afterwards.
• A human in the loop. For decisions that affect people, an employee decides, not the AI.

And the European AI Act?

Alongside GDPR, the EU AI Act has been in force since 2024 and applies in phases. For most SME use cases, such as an internal assistant, invoicing or sorting emails, the risk is limited. The main obligation is then transparency: people must know when they are dealing with an AI system or when content was generated by AI.

Stricter rules apply to high-risk uses, such as AI that decides on hiring or creditworthiness. If your project falls into that category, have it reviewed legally beforehand.

In short

Using AI with customer data is possible, as long as you know where that data goes, have contractual agreements in place and only process what's needed. The biggest risk is often not in a well-designed AI project, but in uncontrolled use of free tools.

Want to know how an AI assistant can work safely with your own documents? Read how an AI assistant that knows your own documents works, or tell us what you're dealing with.