AI and data protection (GDPR): what a business should check
Using artificial intelligence with customer or employee data is compatible with the GDPR, but requires prior decisions. This guide sums up the questions to answer before implementing AI. It doesn’t replace legal advice for your specific case.
What data the AI will process
Start with an inventory: what personal data enters the process, whose it is and whether it includes special categories (health, for example). Many automations can work with minimised or pseudonymised data.
Legal basis and purpose
Every processing activity needs a legal basis (contract, legitimate interest, consent…) and a specific purpose. Using data collected for one thing for another requires checking compatibility.
AI providers and international transfers
- Sign a data processing agreement with each provider.
- Check where data is processed and with what safeguards if it leaves the EEA.
- Confirm whether the provider uses your data to train its models.
Transparency and human review
Inform affected people in your privacy policy and avoid decisions with significant effects made solely by AI. Keeping a person who reviews and can correct is good practice and often a requirement.
Retention and security
Define how long data and generated outputs are kept, who has access and how access is logged.