www.simplify-data.de
AI assistants such as ChatGPT, Microsoft Copilot, Claude or Gemini are already part of daily work in many offices, often without management knowing exactly who uses which tool with which data. From a data protection perspective this becomes sensitive as soon as personal data is entered. This article explains what to look out for under the General Data Protection Regulation (GDPR) and how to organise AI use properly.
Please note: this article does not replace legal advice or consultation with your data protection officer.
When the GDPR applies
The GDPR applies whenever personal data is processed. That means any information relating to an identified or identifiable person: names, email addresses, customer numbers, but also a complaint email that reveals who wrote it.
If someone uses an AI assistant only to phrase a general text or explain a spreadsheet formula, they are usually not processing personal data. It becomes critical when employees paste customer correspondence, job applications, meeting minutes or contracts into the tool.
Personal account or business plan
The key distinction is between consumer accounts and business offerings. With free or personal accounts, vendors often reserve the right to use inputs to improve their models, frequently with an option to opt out. A data processing agreement is usually not available.
Business offerings are structured differently. OpenAI, for example, states that data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu and the API is not used for training by default, and it offers a data processing addendum (as of November 2026). Other major vendors make similar commitments for their business products. Check the current contract terms yourself, as they change regularly.
| Criterion | Personal or free account | Business or enterprise plan |
|---|---|---|
| Data processing agreement | usually not available | generally available |
| Use of inputs for training | often possible, sometimes can be disabled | not by default, according to vendors |
| Central account management | no | yes |
| Choice of data location | no | optional with some vendors |
For business use involving personal data, a personal account is therefore hard to justify.
Data processing agreements under Art. 28 GDPR
When an external provider processes personal data on your behalf, you need a data processing agreement (DPA). It sets out that the provider processes the data only on your instructions, which technical and organisational measures it takes and which sub-processors it uses.
With AI services the classification is not always clear-cut, for example when a vendor also uses data for its own purposes. In that case the vendor may be a controller in its own right, and a DPA alone is not enough. If in doubt, ask your data protection officer to assess this.
You also need a legal basis for each processing activity under Art. 6 GDPR. The DPA only governs your relationship with the provider, not whether you are allowed to use the data for that purpose in the first place.
Transfers to third countries
Many AI vendors are based in the US or process data there. The GDPR only allows transfers to countries outside the EU and EEA under certain conditions (Art. 44 et seq. GDPR).
For the US, the EU-US Data Privacy Framework has been in place since July 2023. It is an adequacy decision by the European Commission: transfers to US companies certified under the framework are considered lawful without additional safeguards. You can check whether a vendor is certified on the official website dataprivacyframework.gov.
The framework is not without controversy, however. The EU General Court dismissed a challenge against it in September 2025, and an appeal against that judgment is pending before the Court of Justice of the EU (as of November 2026). Its predecessors, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice. It therefore makes sense to also look for standard contractual clauses and to have a plan in case the framework falls away.
Some vendors now offer data storage or processing in Europe. OpenAI, for instance, offers European data residency for certain business products and API projects, which has to be actively selected. This reduces third-country exposure but does not necessarily eliminate it entirely, for example for support or sub-processors.
Other obligations to keep in mind
Besides the DPA and international transfers, check the following points:
- Record of processing activities: using an AI service with personal data belongs in this record (Art. 30 GDPR).
- Data protection impact assessment: where processing is likely to result in a high risk to individuals, such as large-scale processing of sensitive data, an impact assessment is required (Art. 35 GDPR).
- Information duties: customers and employees must be informed about the processing, for example in your privacy notice.
- Works council: in Germany, if AI tools are capable of monitoring employee behaviour or performance, the works council may have co-determination rights.
- Confidentiality: regardless of the GDPR, trade secrets and confidential customer data do not belong in tools without suitable contractual safeguards.
The Datenschutzkonferenz (DSK), the joint body of Germany's data protection authorities, has published guidance on AI and data protection that offers a useful framework for your assessment.
Practical measures for everyday use
Even with the right contract in place, the most important lever remains which data is entered in the first place. These principles have proven useful:
- Data minimisation: remove names, addresses and identification numbers before input, or replace them with placeholders.
- Check the output: AI answers can be wrong. Review content before passing it on to customers.
- Approved tools only: use only approved tools with company accounts, never personal accounts.
- Training: explain to employees what is allowed and why. This also supports the AI literacy duty under the EU AI Act.
Checklist: introducing AI assistants in line with GDPR
- Take inventory: which AI tools are already in use, by whom and for what?
- Choose a vendor: a business plan with a DPA, clear rules on training and, ideally, data processing in the EU.
- Review international transfers: Data Privacy Framework certification, standard contractual clauses, sub-processors.
- Define the legal basis and purpose and document them in your record of processing activities.
- Check whether a data protection impact assessment is required.
- Write an internal AI policy: approved tools, prohibited data categories, review duties.
- Involve the works council early, if you have one.
- Train employees and review the rules regularly.
How Simplify Data can help
Simplify Data in Kiel supports companies with the technical rollout of AI assistants and automation, for example with n8n. This includes selecting suitable services, connecting them to existing systems and designing setups that limit data outflow. Please coordinate the legal assessment with your data protection advisor. Learn more on our page about AI and automation.