GDPR basics for companies whose staff use AI tools

Plenty of small companies outside Europe still deal with the GDPR. A design studio in Pune with clients in Germany, an accounting firm in London, a software company with users in France: each handles personal data that the General Data Protection Regulation covers. When their staff paste that data into AI tools, the regulation comes along.

This is a plain overview of the parts that matter for AI use. It is not legal advice; for your own situation, ask a data protection adviser.

Controller and processor

The GDPR separates the controller, who decides why and how personal data is processed, from the processor, who processes it on the controller's behalf. Your company is usually the controller for its customer and staff data. An AI tool provider used for company work may act as a processor, and the GDPR expects a written contract between controller and processor that sets out what the processor may do. Many business plans offer a data processing agreement for this reason. Consumer accounts generally do not.

If a provider uses inputs for its own purposes, such as improving its models, it may be acting as a controller for that use, which raises further questions. This is one reason the plan and its terms matter so much.

Lawful basis and purpose

Every use of personal data needs a lawful basis, such as a contract with the person, a legal obligation, consent or legitimate interests. Data collected for one purpose should not be used for an unrelated one. A customer's support email, collected to answer their question, being pasted into a tool to answer that same question is a different matter from the same email being used to train a model.

Minimisation

Process only the personal data you need. For AI use this principle is the most practical of all: if the task can be done without the name, the address or the account number, leave them out. Replacing names with roles is not just a good habit; it is the principle in action.

International transfers

Personal data covered by the GDPR may only be transferred outside the European Economic Area under certain conditions, such as an adequacy decision or standard contractual clauses. Many AI providers process data in several countries. Check where the tool processes data and what transfer mechanism its terms rely on.

Security and breaches

Controllers must protect personal data with appropriate technical and organisational measures. A personal data breach that is likely to result in a risk to people's rights must be reported to the supervisory authority within 72 hours of becoming aware of it, and in some cases the people affected must also be told. Whether a mistaken paste into an AI tool is a reportable breach depends on the data, the tool and its terms. Decide quickly, with advice, and record the reasoning either way.

Impact assessments

Where processing is likely to result in a high risk to people, the GDPR expects a data protection impact assessment before it starts. Using an AI tool to process large amounts of sensitive data, such as health information, could fall into this category. A short written assessment also forces the questions you would want answered anyway.

Turning this into a checklist

1. Know which AI tools receive personal data, and keep a register.
2. For each, check the plan, the data processing terms, where data is processed and whether inputs are used for training.
3. Allow personal data only into tools where those answers are acceptable.
4. Put the rule and examples in your AI-use policy, and record staff agreement.
5. Have a short incident procedure that includes deciding on breach notification within 72 hours.

The same steps line up closely with India's law, which is useful for companies that deal with both. Read the DPDP Act basics.

In Openn Shield

Openn Shield keeps the records this checklist needs: the AI tool register with allowed data classes, versioned policies with each person's agreement, and a risk register with owners and due dates. Every change goes into an append-only activity trail, and owners can export the workspace's records. Shield does not decide whether something is lawful; that judgement stays with you and your adviser. See the features.