GDPR and AI Tools — What to Watch For
The AI Act isn't the only regulation to keep in mind when rolling out artificial intelligence in your company. GDPR applies in parallel, and in practice it covers almost every use of AI that involves personal data — which, in a small business, is nearly always.
GDPR and the AI Act work side by side, not instead of each other
The AI Act regulates AI systems themselves — their risk classification and the obligations of providers and users. GDPR regulates something different: the processing of personal data itself, regardless of which tool is doing it. If a customer's name and email address, or an employee's data, shows up in a company AI chat, GDPR applies — entirely independently of whether that AI system falls under the AI Act at all. In practice, GDPR is today the broadest regulation touching AI, because it covers every stage: from entering data into the system, through processing it, to any later use for training a model.
What to watch for, step by step
Establish a legal basis for the processing
Using AI to process customers' personal data usually relies on the controller's legitimate interest rather than consent — but that requires a genuine proportionality assessment, not just an assumption that "it's only a supporting tool." For employee data the situation can be more sensitive, because the employer's stronger position makes it harder to rely on legitimate interest without additional safeguards.
Check whether a data protection impact assessment (DPIA) is needed
Not every use of AI requires a formal impact assessment — but regular, systematic, large-scale processing of personal data with AI (for example, automated analysis of job candidates' CVs, or customer scoring) usually does. A good practice is to at least briefly document why a DPIA was judged unnecessary, if the company reaches that conclusion.
Sign a data processing agreement with your AI provider
If an AI provider processes personal data on your behalf (and in practice that's almost always the case when the AI has access to company email, a CRM, or documents), you need a formal processing agreement compliant with Article 28 of GDPR — with concrete technical and organizational safeguards, not just a general acceptance of the service's terms.
Verify where the data physically goes
Many AI providers process data on servers in the US or other countries outside the European Economic Area. Such a transfer requires an additional legal mechanism (such as standard contractual clauses) — simply having a processing agreement isn't enough if it doesn't cover the question of transferring data outside the EEA.
Add AI to your record of processing activities
If your company keeps a record of processing activities (and under the accountability principle it should, even in simplified form as a micro-business), every new, systematic use of AI to process personal data should appear in it as a separate activity, with a description of its purpose, legal basis, and data recipients.
Data subjects' rights — harder in the context of AI
If a customer asks for their data to be deleted, and that data previously ended up in a conversation with an AI, it's worth knowing whether and how your provider handles such requests on their side — deleting data from your own systems isn't the same as deleting it from the AI provider's logs or memory. That's a question to ask the provider before signing an agreement, not the first time a customer files a deletion request.
Practical checklist
- A legal basis established for each use of AI that involves personal data
- A signed processing agreement (Article 28 GDPR) with every AI provider that has access to data
- Data processing location checked and, if needed, a transfer mechanism for data leaving the EEA
- AI added to the record of processing activities as a separate activity
- A short, documented assessment of whether a given use of AI requires a DPIA
- Knowledge of how to handle a deletion request on the AI provider's side
Poland's data protection authority (UODO) published a detailed resource in August 2026 with checklists for organizations rolling out AI, including a simplified version for small and medium businesses using off-the-shelf tools — a good, free reference point for verifying compliance on your own.
Rolling out AI and not sure where to start with GDPR?
We'll help you work through the compliance checklist, choose a provider on the right contract, and fill in the documentation.