GDPR and AI: what a smaller company must check
Updated:
GDPR applies to AI the moment personal data goes in: a customer’s email, a CV, a support ticket with a name in it. It doesn’t ban AI, but it asks the same things as any other processing. Before a smaller company uses an AI tool on personal data, it should know what data goes in, have a legal basis and a data processing agreement with the provider, know where the data is stored, tell the people concerned, and keep a person responsible for decisions about them.
This is general information as of 10 November 2026, not legal advice.
When does GDPR apply to AI?
Whenever an AI tool processes information about an identifiable person. Names, email addresses, phone numbers, call recordings and free text that mentions a customer all count. Your company is the controller: it decides why the data is processed. The AI provider is usually your processor, working on your behalf, and that relationship needs a written contract (GDPR Article 28).
If the AI only sees product descriptions, prices or anonymous figures, GDPR doesn’t apply to that use. That is often the cheapest way to comply: keep personal data out of the steps that don’t need it.
What to check before you use AI on personal data
Go through these per process, the same way as the AI readiness checklist. The articles are from the GDPR.
- What personal data goes in? List the fields. Send only what the task needs, and strip the rest before it reaches the AI (Article 5(1)(c), data minimisation).
- What is the legal basis? Usually the contract with the customer or your legitimate interests, sometimes consent. Using data for a new purpose needs checking against the reason you collected it (Articles 5(1)(b) and 6).
- Is any of it special category data? Health, religion, trade union membership, biometrics and a few others are banned by default, with narrow exceptions. Keep them out unless a lawyer has confirmed an exception applies (Article 9).
- Do you have a data processing agreement? Every provider that processes personal data for you needs one, the AI provider and any automation tool in between (Article 28).
- Where is the data stored and processed? Transfers outside the EEA need a legal basis, such as an adequacy decision or standard contractual clauses (Articles 44–49). See the section on US providers below.
- Does the provider train its models on your data? Read the provider’s terms for the plan you actually pay for. Consumer and business plans often differ.
- Have you told the people concerned? Your privacy notice must say what you do with their data and who receives it, which includes the AI provider (Articles 13 and 14).
- Does the AI decide anything about a person? If yes, see the section on automated decisions below (Article 22).
- Is it written down? Add the processing to your records (Article 30), decide whether you need a DPIA (Article 35), and set how long inputs and outputs are kept (Article 5(1)(e)).
Is ChatGPT GDPR compliant?
No tool is GDPR compliant on its own. What matters is how you use it, and the plan you use it on. OpenAI’s own terms draw a clear line between personal and business plans:
| Plan | Trained on your data by default? | Fit for customer or staff data? |
|---|---|---|
| ChatGPT Free, Plus, Pro | Yes, unless you switch off “Improve the model for everyone” in the data controls | No. These are personal accounts, not a processing arrangement for your company |
| ChatGPT Business, Enterprise, Edu | No | Yes, with a data processing addendum and the checks above |
| OpenAI API | No | Yes, with a data processing addendum and the checks above |
Sources: OpenAI on personal plans and OpenAI on business data, checked on 10 November 2026. OpenAI also offers data residency in Europe for ChatGPT Enterprise, Edu and eligible API customers. Terms change, so check them again before you subscribe. The same questions apply to Microsoft Copilot, Gemini, Claude and any other provider.
Can you use a US AI provider under GDPR?
Yes, if the transfer has a legal basis. Since July 2023, the EU–US Data Privacy Framework lets you send personal data to US companies that have certified under it. Check the provider on the official list. Providers that aren’t listed usually rely on standard contractual clauses in their data processing agreement.
The framework is in force, but it has been challenged. The General Court upheld it in September 2025, and an appeal is pending at the Court of Justice (case C-703/25 P). Its two predecessors were struck down, so prefer a provider whose agreement also includes standard contractual clauses, or one that can store and process your data in the EU.
Do you need a DPIA for AI?
A data protection impact assessment is required when processing is likely to result in a high risk to people (Article 35). The European data protection authorities list nine criteria, and processing that meets two of them needs a DPIA in most cases (DPIA guidelines, WP248). Using new technology such as AI is one criterion, so one more is often enough:
| Use | DPIA? |
|---|---|
| AI scores or filters job applicants | Yes: evaluation of people, and applicants are in a weaker position |
| AI analyses calls or messages to rate staff | Yes: systematic monitoring and evaluation of employees |
| AI handles health or financial details at scale | Yes: sensitive data on a large scale |
| AI drafts replies to customer emails, and a person sends them | Often not, but write down why you decided that |
Your national data protection authority also publishes its own list of processing that always needs a DPIA. Check it before you decide.
Can AI make decisions about people?
Not alone, when the decision matters. People have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on them, such as rejecting a job application or a loan (Article 22). The exceptions are narrow and come with safeguards, such as the right to have a person review the decision.
In practice, let AI sort, summarise and suggest, and let a person decide. That person must actually review the case and be able to change the outcome. Approving every suggestion without reading it doesn’t count as human involvement.
How does GDPR relate to the EU AI Act?
They are two separate laws, and both apply. The AI Act says itself that it doesn’t affect GDPR (Article 2(7)).
| GDPR | AI Act | |
|---|---|---|
| Protects | People’s personal data | Health, safety and fundamental rights affected by AI systems |
| Applies when | Any personal data is processed, with or without AI | An AI system is built or used, with or without personal data |
| Main duties for a company using AI | Legal basis, processing agreements, transparency, people’s rights | Depend on the risk level: banned uses, stricter rules for high-risk uses such as recruitment, telling people when they talk to an AI |
An AI chatbot that answers customer questions and stores their names falls under both: the AI Act for the chatbot, GDPR for the names.
What about the UK?
UK companies follow the UK GDPR and the Data Protection Act 2018, which are close to the EU rules but separate. The Information Commissioner’s Office publishes its own guidance on AI and data protection, which is the reference there.
Can you do this yourself?
For one AI tool on a business plan, mostly yes: the checklist above, a signed data processing agreement and an updated privacy notice cover most of it. Get legal advice when the AI decides about people, touches special category data or monitors staff. When AI is built into your own processes, the design decides how much personal data it sees. vSites does this as AI consulting: we go through your processes, check which data the AI would see and where it would be stored, and give you a fixed-price plan in writing. If you go ahead, we also build the AI automation. We’re developers, not lawyers, so legal questions go to yours.