Your team is already using AI. Someone in support pastes a customer email into a chatbot to draft a reply. A manager uploads a spreadsheet to summarise it. A recruiter screens CVs with a tool nobody in IT has approved. Each moment is data processing under European law — and most businesses have never checked whether the tool was set up to handle personal data lawfully.
That gap is the real GDPR problem with AI: feeding personal data into tools never contracted or documented for it. A GDPR compliant AI tool is not a product you buy with a certificate. It is a tool used in a compliant way: on a business plan, under a signed data processing agreement, with training switched off, and with a clear reason for every piece of personal data it touches. This guide explains how to get there. It is general guidance, not legal advice.
The Direct Answer: Can European Businesses Use AI Tools Under GDPR?
Yes, if the tool runs on a business plan with a signed data processing agreement, personal data is not used to train models, a lawful basis is documented for each use, and high-risk uses such as profiling are assessed before launch. Free and personal tiers generally fail these conditions and should not receive personal data.
What “GDPR Compliant” Actually Means for an AI Tool
There is no official GDPR certification stamp for an AI tool: GDPR regulates how personal data is processed, not which brands are approved. Your business is almost always the controller: you decide why and how personal data goes into the tool. The vendor is usually your processor, handling data on your instructions — but the controller carries the responsibility.
So when a vendor says its tool is “GDPR compliant”, ask what sits behind the claim. A credible answer has four parts: a DPA, a written no-training commitment, clear processing locations, and matching security measures. If a vendor cannot show you those four things, treat the claim as marketing. The same test applies to writing assistants, transcription tools, and CRMs with AI features.
The Six Questions Before Any AI Tool Touches Personal Data
Run every tool through these six questions before personal data goes near it.
| Question | What a good answer looks like |
|---|---|
| Does this tool process personal data? | Exactly what goes in is listed: names, emails, tickets, recordings, CVs, free-text notes. |
| Do we have a signed DPA? | An Article 28 DPA is signed, covering purpose, data types, security, sub-processors, and end-of-service deletion. |
| Will our data train the vendor’s models? | Confirmed in writing, or training is switched off in the settings. |
| What is our lawful basis? | A documented Article 6 basis per use — contract, legitimate interests, or consent — in your processing records. |
| Where is the data processed? | Location is known; transfers outside the EU or UK rest on an adequacy decision or standard contractual clauses. |
| How long is data kept, and can we delete it? | Retention periods are set for prompts, logs, and outputs, and deletion requests can be actioned across the vendor. |
Keep the answers in a simple tool register: one row per tool, one column per question, plus the approver’s name.
Consumer Tiers Versus Business Plans: The Divide That Matters Most
The single most common GDPR mistake with AI is using a personal account for business data. Free tiers and personal subscriptions run under consumer terms: they typically offer no data processing agreement, and their default settings may allow inputs to be used for training. Business and API plans are a different product, built for organisations, offering DPAs and normally excluding customer data from training by default. A small-team vendor comparison shows the same divide across the major providers.
So the rule should be absolute: no personal data in a free or personal AI account, ever. Work needing personal data happens in the approved business tool, or not in an AI tool at all. The same applies to AI features bundled into software you already pay for: check they are covered by your DPA before anyone switches them on.
Lawful Basis, Minimisation, and Retention: The Three Habits
Three GDPR principles do most of the work for everyday AI use. First, lawful basis. Every use of personal data needs a reason recognised by GDPR Article 6: usually contract (using a customer’s details to answer their enquiry), legitimate interests (sorting incoming enquiries, balanced against the person’s rights), or consent (freely given for a specific use). Pick one per use and write it down; a basis that justified answering a support ticket does not justify feeding its history into a model for training.
Second, data minimisation. Send the AI only what it needs. A support chatbot does not need a customer’s full order history to answer a delivery question. Redacting names and account numbers before pasting is the cheapest compliance control there is, and it protects you even when another control fails.
Third, retention. Prompts, transcripts, and AI outputs containing personal data are personal data themselves. Set retention periods and delete on schedule: a chatbot log kept forever makes access and deletion requests far harder than they need to be.
EU Hosting and International Transfers
Where data is processed matters, and AI makes the question harder because one prompt can travel through a vendor, its sub-processors, and model hosts in more than one country. EU hosting is the cleanest starting point for European businesses: it keeps data inside the European Economic Area and simplifies your transfer analysis, even though GDPR allows other lawful transfer mechanisms.
If personal data leaves the European Economic Area, you need a valid transfer mechanism: the EU-US Data Privacy Framework for certified US organisations, or standard contractual clauses with a transfer assessment. Record which mechanism each tool relies on, and confirm where sub-processors sit — a transfer to a US cloud region via a sub-processor is still a transfer.
In Germany and France, this question often decides the vendor shortlist before features are compared, and our Germany and France pages reflect that: European clients expect EU hosting as a first-class option.
Shadow AI: The Policy Your Team Actually Needs
Shadow AI is AI use nobody approved: the employee with a personal chatbot account, the manager uploading a spreadsheet to a free transcription tool, the team trying a new assistant before IT has seen it. It is not sabotage; it is usually the fastest way to get a job done.
The policy that works has four parts. Name the approved tools and the data each may receive. State the red lines — no customer data, health data, or employee data in personal accounts. Give staff an approved alternative that is actually quick to use. And make reporting safe: if someone has already pasted data into an unapproved tool, the business needs to know so it can assess, delete, and record the incident, not punish the report.
Automated Decisions, Profiling, and When You Need a DPIA
Most everyday AI use — drafting, summarising, translating, answering FAQs — does not make decisions about people, and GDPR treats it accordingly. Problems start when AI scores, ranks, or filters people: shortlisting candidates, setting prices, flagging fraud, or deciding who gets a loan. Those uses can be profiling, and in some cases solely automated decisions under Article 22.
A human who rubber-stamps an AI score does not fix this: the reviewer must exercise real, independent judgement, with the information and authority to disagree. Where automated decisions are permitted, you must also explain the logic, offer human review, and give the person a chance to contest the outcome.
A data protection impact assessment (DPIA) is required before processing likely to result in high risk to individuals — systematic profiling, large-scale special category data, or employee monitoring are common triggers. A DPIA — following the ICO’s data protection by design approach — need not be long: it describes the processing, assesses necessity and proportionality, identifies risks, and records mitigations.
AI Chatbots and Agents That Touch Customer Data
Chatbots and AI agents deserve special attention because they sit on the boundary between your business and your customers, and they can expose more data than a back-office tool. A chatbot that answers a delivery question may also see order history, payment details, or health information if the conversation goes there.
Three controls matter most. Permission-aware retrieval: an assistant must respect who may see what. Retention limits on transcripts: transcripts are personal data and should not be kept forever. Human escalation: a customer should be able to reach a person, and a person should be able to correct or delete a record.
These controls also make a chatbot genuinely useful, which is why our AI chatbot development and AI calling agents work treats data handling as part of the build. The same applies to AI integrations connecting AI tools to CRMs: every connection is a data flow, and every data flow belongs in your tool register.
Germany and France: Where National Rules Change the Detail
GDPR is an EU regulation, but member states add their own layers. In Germany, employee-facing AI is shaped by works council rights: tools that monitor employees or affect working conditions generally require consultation with the works council (Betriebsrat), and processor agreements are known as AV-Verträge. A German employer rolling out AI productivity monitoring without that conversation creates a labour-law problem on top of a data-protection one.
In France, the CNIL has published extensive AI guidance, and employers face similar consultation expectations. French customers also expect clear AI information in plain French. Do not copy a US or UK rollout plan into Europe unchanged.
The EU AI Act Sits Alongside GDPR, Not Instead of It
GDPR is not the only European law that touches AI. The EU AI Act adds risk-based obligations, strictest for high-risk uses such as employment decisions, credit scoring, and biometric identification, including risk management, data governance, human oversight, and record-keeping. For most small businesses this is reassuring: the GDPR governance already described covers much of the groundwork.
A Practical Rollout Plan for the Next 30 Days
You do not need to fix everything this week. Week one, inventory: list every AI tool, its users, and the personal data it receives; ban personal data in personal accounts from today. Week two, contracts: request DPAs for every tool that touches personal data, confirm training opt-outs in writing, and record processing locations and transfer mechanisms. Week three, policies and notices: publish the shadow AI policy, update your privacy notice to describe AI processing honestly, and set retention periods. Week four, high-risk review: identify any profiling, scoring, or automated decisions, run DPIAs where needed, and build human review into those workflows. Then schedule a quarterly review: a DPA signed last year may not describe this year’s product.
If that sequence is more than your team can carry alongside running the business, outside help pays for itself. AI Dev Expert builds AI solutions with data handling designed in from the start, including permission-aware retrieval and EU hosting options. Pricing is provided as a custom quote after a requirements discussion, request a free quote to talk through your tools and data flows. You can also review how we handle data on our privacy policy page.
Frequently Asked Questions
Is ChatGPT GDPR compliant?
It depends on how you use it. Business and API plans offer DPAs and exclude customer data from training, which can support compliant use. Free and personal plans generally do not offer a DPA and may use inputs for training, so they should not receive personal data.
Do I need a data processing agreement for AI tools?
Yes, if the tool processes personal data on your behalf. GDPR Article 28 requires a written contract between controller and processor covering purpose, duration, data types, security, sub-processors, and deletion or return of data at the end of the service.
When do I need a DPIA for AI?
A data protection impact assessment is required before processing likely to result in high risk to individuals. For AI, that commonly includes systematic profiling or scoring, large-scale processing of special category data, and employee monitoring. If a DPIA shows high residual risk you cannot mitigate, consult your supervisory authority before deploying.
Can AI make automated decisions under GDPR?
Only with safeguards. GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing with legal or similarly significant effects. Where permitted, you must inform the individual, explain the logic in understandable terms, and offer human review and the chance to contest.
What is shadow AI under GDPR?
Shadow AI is unapproved AI use by employees, such as pasting customer data into a personal chatbot account or uploading documents to a free tool. It creates risk because there is no DPA, no training opt-out, and no record of the processing. The remedy is an approved-tool list, clear red lines, a safe alternative, and training on real examples.
Does GDPR apply to US companies using AI?
Yes, if they offer goods or services to people in the EU or monitor their behaviour, GDPR applies regardless of where the company is based. US businesses selling into Europe need the same foundations.
General guidance only, not legal advice. Rules and regulator guidance change; consult a qualified data protection professional before deploying high-risk AI processing.
USA
UK
Canada
Germany
UAE
Australia
S. Africa
France
Netherlands
Ireland
Spain
Italy
Sweden
Switzerland
Belgium