What does using AI in a GDPR-proof way mean?
Using AI in a GDPR-proof way means you follow the rules of the General Data Protection Regulation (GDPR) every time you use AI with personal data. The GDPR applies as soon as you process data that can be traced to a person, such as names, email addresses, customer files and job application letters. Which technology you use for that makes no difference to the law.
As a business you are the controller. The provider of the AI tool is in most cases your processor. GDPR-proof is a common term without legal status. Your own processing remains your responsibility, whichever tool or supplier you choose.
This article describes what the rules ask for and what you arrange in practice, as of October 2026. It is general information. Put your own situation to a lawyer or your data protection officer.
What does the GDPR ask when you use AI?
For AI use the GDPR asks the same as for any other processing of personal data. These parts come up most often with AI:
| Topic | GDPR article | What you arrange |
|---|---|---|
| Legal basis | 6 | You determine on which legal basis you process the data |
| Purpose and data minimization | 5 | You only process the data needed for the purpose |
| Informing people | 13 and 14 | Your privacy notice describes that and how you use AI |
| Rights of data subjects | 15 to 17 | You can provide access to data and correct and erase it |
| Automated decisions | 22 | People have the right not to be subject to a fully automated decision with major consequences |
| Data processing agreement | 28 | You lay down in writing what the AI provider does with the data |
| Security | 32 | You take appropriate technical and organizational measures |
| DPIA | 35 | Where a high risk is likely, you carry out a data protection impact assessment beforehand |
| Transfers outside the EU | 44 to 49 | You have a valid basis for transfers to countries outside the European Economic Area |
On the data processing agreement the Dutch Data Protection Authority (AP) is clear: if you work with a processor without written agreements, you as controller are in breach. The obligation is in Article 28(3).
The highest fine category of the GDPR is 20 million euros or 4 percent of worldwide annual turnover, whichever is higher (Article 83).
Where does it go wrong with AI and personal data?
It goes wrong most often when employees enter personal data into an AI chatbot on their own initiative. On 6 August 2024 the AP reported that it had received several notifications of data breaches that arose this way.
The AP gives two examples. An employee of a GP practice entered patients' medical data into an AI chatbot, against the agreements. At a telecom company an employee entered a file with customers' addresses.
According to the AP most companies behind chatbots store the data that is entered. The data then sits on the provider's servers, often without the employee realizing it. The regulator's advice is to make clear agreements: may employees use AI chatbots, and if so, which data may go into them.
If an employee does leak personal data through an AI tool, a notification to the AP and to the people affected is mandatory in many cases, according to the AP.
Can you send personal data to an American AI provider?
You can if you have a valid basis for the transfer. For the United States the European Commission's adequacy decision for the EU-US Data Privacy Framework has applied since 10 July 2023.
According to the AP you may transfer personal data to American organizations that participate in that framework, without additional legal and technical measures. So check whether your AI provider participates. The predecessor of this framework, the Privacy Shield, was declared invalid in 2020 by the Court of Justice of the EU in the Schrems II case.
You have two other routes as well. Some providers offer storage in Europe for business subscriptions. You can also run a model on your own hardware, so the data does not leave your own environment. How that works is covered in running AI locally.
Does the AI provider use your data to train models?
That differs per provider and per subscription, and it is in the terms you agree to. As an example, the terms of Anthropic, the maker of Claude (as of October 2026):
- Commercial products such as Claude for Work and the API: inputs and outputs are not used to train models by default
- Personal subscriptions (Free, Pro and Max): chats are used for training if you allow that in the settings
Check three points with every provider: the training setting of your subscription, the retention period of your input and whether a data processing agreement comes with the subscription. For work with customer data you choose a business subscription.
What do you arrange in practice for GDPR-proof AI?
In practice you arrange six things, in this order:
Step 1: make an overview. List which AI tools your business uses and which personal data ends up in them. Include this in your record of processing activities.
Step 2: record the legal basis and the purpose. Note per application why you process the data and on which legal basis.
Step 3: sign a data processing agreement. Do that with every AI provider that processes personal data for you. Tools where that is not possible you do not use for personal data.
Step 4: draw up an AI policy. Describe which tools are allowed, which data may and may not go into them and who the point of contact is.
Step 5: update your privacy notice. Describe that you use AI, for what and with which providers. Have a digital worker in customer contact state that it is an AI system.
Step 6: assess the risk. If you process sensitive data or process on a large scale, check whether a DPIA is needed. The AP publishes guidance on generative AI and the GDPR.
If you use an AI agent for customer contact, also read what specifically applies to an AI agent and the GDPR.
How does the GDPR relate to the EU AI Act?
The GDPR and the EU AI Act apply side by side. The GDPR is about personal data. The AI Act sets requirements for AI systems and their use, also when no personal data is involved.
The transparency rules of the AI Act have applied since 2 August 2026: people must know they are communicating with an AI system. The rules for high-risk AI, such as software for recruitment, apply from 2 December 2027. The risk levels and all dates are in our EU AI Act explainer.
Frequently asked questions
Can I enter customer data into ChatGPT or Claude? Only if you meet the GDPR: you have a legal basis, a data processing agreement with the provider and a valid basis for transfer. The Dutch Data Protection Authority received reports of data breaches because employees entered personal data into AI chatbots.
Do I need a data processing agreement with my AI provider? Yes, if the provider processes personal data for you. Article 28 of the GDPR requires a written agreement. According to the Dutch Data Protection Authority you are in breach without that agreement.
Is an AI tool with servers in the EU automatically GDPR-proof? No. Storage in the EU resolves the transfer question. The other obligations still apply, such as a legal basis, data minimization, security and a data processing agreement.
How high is the fine for a GDPR infringement? The highest fine category is 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. That is in Article 83 of the GDPR.
Do I have to do a DPIA before I use AI? A DPIA is mandatory if the processing is likely to result in a high risk for the people concerned (Article 35 GDPR). Think of sensitive data or large-scale processing. Assess this per application.
Moving forward with AI in your business
Learn to work safely with AI in a 1-on-1 AI training, read more about AI and privacy or book a no-obligation call about your situation.
