Using AI in line with data protection: how to choose the right provider
6 min read
Short answer
To use AI in line with the GDPR, check five points above all: a data processing agreement, where data is processed, exclusion of your data from training, retention and deletion, and secure access. European providers or the EU data centres of large providers make much of this easier. Very sensitive data can also be processed on your own servers.
What does this mean for your company? Book an intro call
Data protection is a legitimate concern in AI projects, but rarely a reason to do without AI. With the right questions for the provider and a few clear rules, AI can be used in line with data protection law in most cases. What matters is doing the check early, not just before launch.
Which questions should you ask every provider?
- Is there a data processing agreement? As soon as personal data is processed, it is usually mandatory (Art. 28 GDPR). Business plans offer one, free private accounts usually do not.
- Where is the data processed? Within the EU is simplest. Transfers to other countries come with additional requirements (Art. 44 et seq. GDPR).
- Is my data used for training? This should be excluded by contract.
- How long are inputs stored? Clear retention periods and the ability to delete data belong here.
- How is access secured? Two-factor sign-in, roles and rights, logging of access.
US provider or European provider?
This question is often debated on principle. Viewed pragmatically: large US providers now offer business customers contracts, processing within the EU and exclusion from training. For the US there is also an adequacy decision, the EU-US Data Privacy Framework, although its future is contested. A residual risk remains, because US authorities may under certain circumstances access data even in European data centres.
European model providers and German data centres that host open models avoid this question. Their quality is good enough for many typical tasks. My recommendation: the more sensitive the data, the more everything points to a European solution. For general texts without personal data, the choice is less critical.
When do you need a data protection impact assessment?
When processing is likely to result in a high risk for the people affected (Art. 35 GDPR). With AI, this can be the case when employees are systematically evaluated, special categories such as health data are processed, or decisions about people are prepared. For reading invoices or sorting emails it is usually not needed. Involve your data protection officer early.
Which data does not belong in AI tools?
Without suitable safeguards, health data, personnel files, trade secrets and confidential contracts do not belong in freely available tools. Clear rules for your team are in ChatGPT at work.
And if the data should not leave the building?
Then open models can run on your own servers or with a German hosting provider. That costs more but gives you full control. Do we need our own AI model? explains the difference between running a model yourself and training one. The additional obligations under the EU AI Act are covered in The EU AI Act for SMEs.
Julius Launhardt brings AI into small and mid-sized companies with data protection in mind, preferably with European providers and a sense of proportion. This does not replace legal advice. More on the IT, data and AI security page.
Frequently asked questions
May I use US providers such as OpenAI or Microsoft?
In principle yes, if the contract, legal basis and transfer are covered. There is currently an adequacy decision by the European Commission for the US. Many business plans also offer data processing within the EU.
Do I need a data protection impact assessment?
Not for every use of AI. It is required if the processing is likely to result in a high risk for the people affected, for example when systematically evaluating employees. Your data protection officer can assess this.
Is it enough to remove names before entering data?
It helps and is a good habit. But people can often be identified without names, for example through customer numbers or details in the text. Pseudonymised data is still personal data.
Are European AI models worse?
The gap has narrowed considerably in recent years. For many typical SME tasks, such as reading documents or sorting emails, European and open models work well. Test with your own examples.