Practical AI. Measurable progress.
GDPR and AI: trace the data
Review the actual information, purpose, provider terms and access before sending data to a model. Informational guidance, not legal advice.
Classify before you share
Identify personal, confidential and special-category data. Minimise input and avoid sending customer records when a redacted or synthetic example is sufficient.
Check the whole arrangement
Review lawful basis, controller/processor roles, DPA, subprocessors, transfers, retention, training use and deletion. An enterprise subscription or EU region does not answer all of these questions.
Check model anonymity carefully
Do not assume an AI model is anonymous simply because its output looks generic. Ask a privacy specialist to assess the particular processing and safeguards.
Sources and further reading
Reviewed: 2026-10-22
Assess your starting point yourself, or work through it together.
Take the free assessment →