Artificial intelligence promises real time savings: writing, sorting documents, customer service, analysis. But as soon as a tool processes personal data, the GDPR applies. The good news: becoming compliant is far from insurmountable for a small or mid-sized business, provided you ask the right questions before getting started. This guide gives you a simple method, concrete examples and the mistakes to avoid so you can deploy AI with confidence.
Many companies adopt an AI assistant overnight, without asking where the data they enter actually goes. Yet pasting a client contract, a payslip or an email address into an online tool is already a personal data processing activity. The question isn't whether to use AI, but how to do it properly. This article gives you the practical instincts to use it without turning your project into a legal risk, and without drowning in jargon.
Why the GDPR affects (almost) every AI project
The GDPR (General Data Protection Regulation) governs the processing of any information relating to an identifiable individual: name, email, phone number, customer ID, but also a photo, a voice or a purchase history. Most business AI use cases handle this kind of data, often without anyone realizing it. Simply entering or uploading this information into a tool constitutes processing, even if you don't store anything yourself.
- A customer service chatbot reads messages, and therefore customers' contact details and requests.
- A meeting-summary tool processes participants' names and remarks.
- A resume-screening AI handles sometimes sensitive data (health, ethnic origin, family situation).
- A sales-writing assistant accesses your prospect database.
- A voice transcription tool records and analyzes the voice, which is personal data in its own right.
As soon as one of these processing activities exists, you are the data controller: it's up to you to ensure the data is used lawfully, transparently and securely, including when the computation is carried out by an AI provider. In other words, you can't offload your responsibility onto the software vendor. If you're just starting out, it helps to place this framework within a broader approach to deploying AI in a small business, where compliance is built in from the scoping phase.
Personal data or not?
A fully anonymous text (no name, no identifier, no way to trace it back to a person) falls outside the scope of the GDPR. But true anonymization is hard: a first name paired with a city can be enough to re-identify someone. Pseudonymization (replacing a name with a code) reduces the risk but doesn't take you out of the GDPR. When in doubt, assume the GDPR applies.
The five questions to ask before launching an AI tool
Before any deployment, take an hour to answer these questions. They form the foundation of a compliant AI project and will spare you the majority of mistakes. Write your answers down: this document will serve as a record in the event of an audit and will make updating your processing register easier.
- 1What data will I actually process, and is it personal or sensitive?
- 2Which legal basis am I relying on: consent, contract, legitimate interest, legal obligation?
- 3Where is the data hosted, and is it transferred outside the European Union?
- 4Does the provider use my data to train its own models?
- 5How do I inform the individuals concerned, and how do they exercise their rights?
The question of the legal basis is central and often overlooked. You don't process data simply because it's convenient: you need a legal ground. For the customer relationship, this is generally performance of the contract or legitimate interest; for prospecting or the use of sensitive data, explicit consent is often required. A poorly chosen legal basis can invalidate the entire processing activity, even if the tool is otherwise excellent.
The minimization principle, your best ally
The most protective rule is also the simplest: only submit to the AI the data strictly necessary for the task. Before pasting an entire document, ask yourself whether the full name, the address or the social security number are truly useful to the expected result. Often, the answer is no. Removing or masking these elements upfront mechanically reduces your exposure, at no cost to performance.
The trap of data sent to the models
The most underestimated issue concerns the transfer of data to the AI provider. Many consumer tools are hosted in the United States and, depending on their terms, may reuse your inputs to improve their models. In practice, a piece of customer data pasted into a free interface can slip out of your control, and there's no guarantee it will be deleted at your request.
Two reflexes are essential. First, check the terms of use: look for a do-not-use-my-data-for-training option, often available on professional plans and rarely enabled by default. Second, favor solutions that offer European hosting or local processing when the data is sensitive. The choice between cloud and processing on your own machine is decisive: we cover it in detail in our comparison of local versus cloud AI for your data.
| Type of use | Risk level | Best practice |
|---|---|---|
| Writing generic content (no customer data) | Low | A standard tool is sufficient |
| Summarizing non-sensitive internal documents | Medium | Pro plan with training opt-out |
| Processing customer or HR data | High | Data processing agreement, EU hosting |
| Health, judicial or biometric data | Very high | Impact assessment and legal advice |
The data processing agreement is not optional
When an AI provider processes personal data on your behalf, Article 28 of the GDPR requires a contract setting out its obligations (security, confidentiality, deletion of data at the end of the contract). Make sure your provider offers this document, often called a DPA (Data Processing Agreement). If it doesn't exist, that's a serious red flag about how seriously the vendor takes its responsibilities.
Transfers outside the EU: what to check
Transferring data outside the European Union isn't prohibited, but it must be properly framed. Check whether the vendor adheres to a recognized framework (such as the Data Privacy Framework for the United States) or relies on standard contractual clauses. This information is normally found in the provider's privacy policy or DPA. If you have doubts about a US tool, a European alternative or local processing remains the safest route.
A concrete example: digitizing and using documents
Take a common case in a small business: an accounting firm or a tradesperson wants to automatically extract the text from invoices or paper mail in order to file and analyze it. This is an excellent AI use case, but these documents contain names, addresses and amounts, and therefore personal data. Sending these files to an unknown server multiplies the risks needlessly.
The right approach is to process these files with a tool that doesn't ship your documents off to an uncontrolled server. Processing directly in the browser, with no upload to a third-party server, considerably reduces the risk: the data never leaves your machine. To dig deeper into how this works, see our article on automating data extraction with AI and OCR.
Extract text without exposing your documents
Our OCR tool recognizes the text in your images and PDFs directly in your browser. Your files are not uploaded to a server, a real plus for confidentiality and GDPR compliance.
Common mistakes that come at a high cost
Most incidents don't stem from malicious intent, but from everyday habits. Knowing them lets you defuse them before they happen.
- Pasting customer data into a free tool without reading the terms of use.
- Leaving the training option enabled by default on a professional plan.
- Forgetting to mention the use of AI in the website's privacy policy.
- Entrusting a decision (hiring, credit refusal, contract termination) to the AI alone, with no human review.
- Failing to update the processing register when a new tool is adopted.
- Assuming a tool is compliant because it's popular: fame is no legal guarantee.
An internal policy changes everything
The most cost-effective measure for a small or mid-sized business is a one-page usage policy: what can and cannot be entered into an AI tool, which tools are authorized, and who to contact in case of doubt. Simple to write, it prevents the vast majority of data leaks caused by improvised use by teams.
Putting good practices in place day to day
Beyond the choice of tools, a few habits protect your business over the long term. They rest on the principle of minimization and on a simple idea: compliance is played out in everyday actions, not just in a document filed away in a drawer.
- Anonymize or pseudonymize data before submitting it to an AI whenever possible.
- Write a simple internal policy: what can and cannot be entered into an AI tool.
- Keep your processing register up to date by adding each new AI use case.
- Inform customers and employees about the use of AI in your privacy policy.
- Set a retention period and a deletion process for the data you process.
- Keep a human in the loop for any important decision, never the AI alone.
This last rule is also plain common sense: an AI can be wrong, and sometimes confidently invent a false answer. For screening applications, a customer reply or a financial analysis, human oversight remains essential, both for quality and for compliance. These habits fit into a broader approach to securing the use of AI in your company, which also covers access management and team awareness.
Compliance is not a brake on innovation, it's the framework that lets you innovate without endangering your customers' trust.
Do you need a data protection impact assessment (DPIA)?
Some projects require a data protection impact assessment (DPIA), an exercise that documents the risks and the measures taken to reduce them. It becomes mandatory when the processing is likely to result in a high risk to individuals: large-scale profiling, sensitive data, systematic monitoring. For a small business, most common AI uses don't require one, but you need to be able to recognize the cases where it's called for.
- Processing of health, biometric or judicial data: a DPIA is generally required.
- Automated scoring or rating of customers or candidates: plan for a DPIA.
- A simple writing assistant working on non-personal content: no DPIA needed.
- When in doubt, the data protection authority publishes free lists and templates to guide you.
Frequently asked questions
How do I know if my use of AI is GDPR-compliant?
Start by identifying whether you're processing personal data and on which legal basis. Then check where the data is hosted, whether a data processing agreement (DPA) exists, and whether there's an opt-out from training. If these four points are covered and a human validates important decisions, you're on solid ground.
Can I use ChatGPT or a free tool with customer data?
It's not advisable with consumer versions, which may reuse your inputs to train their models. For customer data, favor a professional plan with a training opt-out and a data processing agreement, or anonymize the data before entering it. Best of all, never paste sensitive information into a tool whose terms you don't control.
How long does it take to bring an AI project into compliance?
For a simple use in a small business, a few hours are often enough: an hour to work through the five key questions, and a bit of time to check the provider's terms and update the register. Complex projects involving sensitive data take longer, especially if an impact assessment is needed.
Why do you need to keep a human in the loop?
Because an AI can be wrong or produce a false answer convincingly, and because the GDPR regulates fully automated decisions that affect a person. Human review protects both the quality of your results and your company's compliance, particularly for recruitment, credit or customer service.
What is the main legal risk with AI and the GDPR?
The most common risk is the uncontrolled transfer of personal data to a provider that reuses it or hosts it outside the EU without a proper framework. Next comes the absence of a clear legal basis and the failure to inform the individuals concerned. These three points together are enough to expose a company to a complaint or an audit.
In summary
AI is a major opportunity for small and mid-sized businesses, and the GDPR isn't there to prevent it: it simply provides a framework for responsible use. Remember the essentials: identify the personal data involved, choose a clear legal basis, favor tools that respect confidentiality, frame your providers with a contract, and always keep a human at the controls. The best time to build in compliance is at the start of the project, not afterward. By laying these foundations from the outset, you turn a regulatory constraint into a competitive advantage and prove to your customers that you take care of their data. If you'd like an outside perspective on your use case, let's talk: TC Automation helps you design useful automations and AI solutions, tailored to your business and compliant with the GDPR by design.
