GDPR and AI tools: what a small firm must check

The route a prompt takes

Nothing on the slip asks whether the tool is “GDPR compliant”. The regulation puts its duties on whoever decides why and how the data is processed, the controller in Art. 4(7), and that is the firm whose staff paste the client’s email in. The vendor’s pages are evidence for stops 02 to 04. They are not an answer to stops 01, 05 and 06, which depend on what your staff do with the tool.

Purpose and legal basis come before the tool

Client data came to you for a reason: a tax return, a tenancy, a payroll run. Feeding it to an AI tool is a further use, and Art. 5(1)(b) allows a further use only if it is not incompatible with that first purpose. Where the new use rests on neither consent nor a law, Art. 6(4) lists what to weigh: the link between the two purposes, the context and your relationship with the person, how sensitive the data is, the consequences for them, and safeguards such as pseudonymisation. Drafting a reply to the client who wrote in sits close to the original purpose. Pasting a whole client list in to brainstorm a marketing campaign does not.

The legal basis is one of the six in Art. 6(1): consent, contract, legal obligation, vital interests, public task or legitimate interests. Which one fits depends on the use. If you rely on legitimate interests, the EDPB has set out how it reads that test for AI.

The three-step test, as the EDPB applies it to AI

1. A legitimate interest. It must be lawful, clearly and precisely articulated, and real and present rather than speculative. The EDPB’s own deployment example is improving threat detection in an information system.
2. Necessity. Would the processing actually serve that interest, and is there no less intrusive way? The amount of personal data is weighed against the data minimisation principle.
3. Balancing. The interest must not be overridden by the person’s rights. Their reasonable expectations count: what they were told and the context in which you got the data.

That is from EDPB Opinion 28/2024, adopted on 17 December 2024. It answers questions about developing and deploying AI models, and it “recalls” the three steps rather than inventing new ones: they are the general Art. 6(1)(f) test, which a firm that only uses a tool runs too.

Data you keep out unless the use has been assessed for it

Art. 9(1) prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify someone, health data, and data about a person’s sex life or sexual orientation, unless one of the exceptions in Art. 9(2) applies. A sick note, a disability adjustment or a grievance file is that kind of data. Art. 5(1)(c) adds the everyday rule: only what the task needs. Most drafting and summarising works just as well with the name, the account number and the address taken out.

The account decides the terms

The same model can sit behind a personal sign-up and behind a company workspace, under different terms. The vendors draw the line themselves: Anthropic keeps separate privacy articles for its consumer plans and for its commercial products, and its processing addendum comes with the Commercial Terms; Google applies its Cloud Data Processing Addendum to Gemini used under a Workspace agreement. A member of staff who signs up with a personal email brings none of that with them.

Art. 28(1) lets a controller use only processors that give sufficient guarantees, and Art. 28(9) wants the contract in writing, electronic form included, so accepted online terms count as long as they carry the clauses. Art. 28(3) lists what those clauses must make the processor do. Read against an AI tool, they turn into concrete things to find:

One clause matters more for AI than for most software. Under Art. 28(10), a processor that starts deciding the purposes and means of processing is treated as a controller for that processing. A vendor that uses your clients’ data to improve its own model for everyone may be making that kind of decision, which is why the training answer belongs in the contract and not in a help-centre article alone. A data processing agreement template shows the full clause set if you need to compare a vendor’s addendum line by line.

The California version is looser on one point

Under the CCPA a vendor is a “service provider” only under a written contract that bars it from selling or sharing the data, using it beyond the contracted business purposes, or using it outside the direct relationship with you (Civ. Code § 1798.140(ag)(1)). The regulations then allow one use the contract need not name: internal use “to build or improve the quality of the services it is providing to the business”, as long as the vendor does not use the data to perform services for someone else (regs § 7050(a)(3)). The regulation’s own example lets an email platform improve its service with one client’s data and offer the improvement to everyone. Whether training a shared model sits inside that line is not settled by the examples, so the contract should say it plainly either way.

Training, feedback and what the vendor keeps

Three questions settle most of stop 03, and each has to be answered from the vendor’s own pages for the plan you are on, not from a review site or a sales call: does it train on prompts by default, what does a feedback click send, and how long are chats and files kept? Here is what four business and personal plans say about themselves.

Read across the rows and one pattern stands out: on the three business plans the default answer to training is no, and the exceptions run through feedback and opt-ins. A “thumbs down” on a draft that quoted a client’s file is an easy path to miss. The region column matters for stop 04: the model that answers a prompt can belong to a different company than the app the staff member opened.

Where the prompt is processed

Chapter V of the GDPR follows personal data out of the EU, and Art. 44 extends the conditions to onward transfers, from the first recipient to the next. For an AI tool that chain is often app vendor, then model host, then the host’s data centre region. Each link needs a route.

That decision, of 10 July 2023, is the first route: a US recipient on the list needs no further authorisation under Art. 45(1). A recipient not on the list needs the second route, appropriate safeguards under Art. 46, which for most vendors means the Commission’s standard contractual clauses (Art. 46(2)(c)) inside the processing addendum. The Commission says the US national-security safeguards behind the decision apply to transfers to US companies whatever transfer tool is used, clauses included. The guide on whether Google Analytics is GDPR compliant walks through what the decision changed and the court challenge brought against it.

The second link in the chain is the easy one to miss. Microsoft’s Copilot privacy page names Anthropic and OpenAI as sub-processors for some Copilot experiences, lets admins decide whether to use those models, and says the Anthropic models are currently excluded from the EU Data Boundary. Whether data leaves the EU can depend on a model setting, not on the app.

A US firm with no EU office asks a question before this one: does the GDPR reach it at all? That turns on what it does toward people in the EU, and Art. 3 decides it for US companies.

Whether a DPIA is due before the first prompt

Art. 35(1) asks for a data protection impact assessment before processing that is likely to result in a high risk, “in particular using new technologies”. A DPIA is not due for every AI use; the wording points at the use, and AI is named as a reason to look harder, not as a trigger on its own. Art. 35(3) names three cases where it is always required:

• systematic and extensive automated evaluation of people, profiling included, with decisions that have legal or similarly significant effects;
• large-scale processing of special-category or criminal-offence data;
• systematic monitoring of a publicly accessible area on a large scale.

Put two uses side by side. A tool that drafts one reply from one client email evaluates nobody. A tool that ranks every applicant for a job, or reads every patient note to flag follow-ups, sits close to the first two cases. Each supervisory authority also publishes its own list of processing that needs a DPIA (Art. 35(4)); check the list of the authority you answer to before you rule a use out.

What the assessment has to hold

1. A systematic description of the processing and its purposes, with the legitimate interest where one is relied on.
2. An assessment of necessity and proportionality against those purposes.
3. An assessment of the risks to people’s rights and freedoms.
4. The measures to address them: safeguards, security, and ways to show compliance.

That is the Art. 35(7) minimum. Most of it comes straight from stops 01 to 04: the purpose line, the three-step test, the vendor’s terms, the transfer chain. Art. 35(11) adds a review whenever the risk changes, and a vendor switching model host can be that kind of change. The privacy impact assessment template walks through the same four parts and prints the result.

The California risk assessment

For a business the CCPA covers, the regulations require a risk assessment before processing that presents significant risk, and the list in § 7150(b) includes using ADMT for a significant decision and using personal information to train ADMT for significant decisions or identification or profiling technology. For covered processing begun before and continuing after 1 January 2026, the assessment has to be conducted and documented no later than 31 December 2027; for assessments in 2026 and 2027, the required information goes to the Agency by 1 April 2028.

When the output decides about a person

Most office uses of AI never reach this stop: a person reads the draft and sends their own answer. It is the uses that sort people that do. A CV screen that rejects applicants before anyone reads them, a tool that sets a customer’s credit limit, a rota tool that hands out shifts and pay. California now has its own rules for that kind of use, and they are more specific than Art. 22 about what a human in the loop must do.

The human in the loop, written down

The California definition is the more useful test even for a firm that only answers to the GDPR, because it says what a reviewer must actually do. A manager who clicks “approve” on every ranking without the authority or the information to change it would not meet the three conditions in § 7001(e)(1). The definition also leaves out tools that do not replace a decision: spellchecking, calculators, spreadsheets, databases, spam filters, provided they do not replace human decisionmaking.

The CCPA only binds a “business” that meets its thresholds, which the CCPA threshold calculator tests. One that does and uses ADMT for a significant decision gives a Pre-use Notice at or before collection, which may sit inside the notice at collection if it carries the required content (§ 7220(a)), and confirms receipt of a request to access or appeal ADMT within 10 business days (§ 7021(a)).

The AI Act, by date, and the word “compliant”

The EU AI Act sits beside the GDPR, not on top of it. The Commission’s AI Act page gives its timeline: in force on 1 August 2024, applicable on 2 August 2026, with prohibited practices and AI literacy from 2 February 2025. The AI Omnibus, in force since 27 July 2026, moved the rules for high-risk uses in sensitive areas, employment among them, to 2 December 2027. The Commission’s own example of a high-risk employment tool is CV-sorting software for recruitment.

For a firm whose staff only use AI tools, the duty most likely to touch it already is AI literacy, and the Omnibus rewrote it. Art. 4 now asks providers and deployers to “take measures to support the development of AI literacy of their staff”, and says the duty does not require them to guarantee any specific level of AI literacy of any individual. The article names no measure. A written staff rule and a short briefing are at least something you can point to.

What a vendor’s claim is worth

The EDPB wrote that about the EU declaration of conformity the AI Act asks of providers of high-risk systems; the same caution is worth applying to any vendor’s badge. In the same opinion it tells supervisory authorities to take into account whether a firm deploying a model built by someone else made an appropriate assessment that the model was not developed by unlawfully processing personal data, looking at the source of the data and at whether a supervisory authority or a court has found an infringement. The level of detail expected rises with the risk of the use (paras 129–130).

Clear one use before staff start

Six questions, one per stop on the routing slip. Answer them for one use of one tool, and the note below lists what is still open, with the rule each item comes from. Copy it into the file you keep for the tool, or print it. A firm clearing many uses across several tools may want them in one register, which is what GDPR compliance software keeps.

Questions