Using AI in compliance with the GDPR: a checklist for companies

An AI assistant that reads manuals, contracts and customer files almost always processes personal data: names of contacts, employees and customers. So the General Data Protection Regulation (GDPR) applies in full. The AI tool changes nothing about that. It only changes how much data is read in one place at once, and who gets to see it on the way.

This article is written for managing directors, heads of legal, HR and compliance in mid-sized companies. It names the questions that must be answered before any tool, condenses them into a ten-point checklist and compares three deployment options.

Why the AI tool does not change the legal position

The GDPR attaches to the processing of personal data, not to the technology. Whether a person opens a document or a language model reads it: the processing needs a purpose, a legal basis and an adequate level of protection. What is new with AI is mainly that documents from many sources come together in one index, that an external provider can often read them, and that the model's output can itself contain personal data again.

Which questions must be settled before any AI tool?

Purpose and legal basis (Art. 6 GDPR)

Every processing operation needs a specific purpose and a legal basis under Art. 6 GDPR. For employees and customers this is usually the performance of a contract or a legitimate interest, which must be weighed against the interests of the data subjects and documented. “We want to try AI” is not a purpose. “Answering questions about internal policies from the approved manuals” is one.

Data minimisation

Only the data needed for the purpose are processed (Art. 5(1)(c) GDPR). For an AI tool this means: connect only the collections the purpose requires, and pseudonymise or remove personal details wherever the task allows it. An assistant for work instructions does not need personnel files.

Where are the data processed, and by whom?

Ask the provider for the location of every processing step: storage, index, model call, logs, backups, support. Ask for the list of sub-processors, with their registered seat and place of processing.

Is the provider a processor? Then a data processing agreement is mandatory

If a provider processes personal data on your behalf, it is a processor. Art. 28 GDPR then requires a data processing agreement (in German: AV-Vertrag) with a prescribed content: subject matter, duration and purpose, categories of data, processing only on instructions, confidentiality, security measures, sub-processors, deletion at the end, evidence and audit rights. The EU Commission provides standard contractual clauses for this (Implementing Decision (EU) 2021/915). A tool whose provider offers no data processing agreement is out of the question for personal data.

Transfers to countries outside the EU

If data are processed outside the European Economic Area, Chapter V of the GDPR applies (Art. 44 and following). A transfer is permitted if the EU Commission has certified that the country offers an adequate level of protection (adequacy decision), or if standard contractual clauses (Implementing Decision (EU) 2021/914) are agreed, supplemented by a documented assessment of whether the law of the destination country undermines the clauses. For the USA, the EU-US Data Privacy Framework has existed since July 2023 for certified US companies. It has been challenged in court; check its status at the time of your decision. A data centre in Frankfurt does not help if support or the model call come from the USA.

Is training on your data excluded by contract?

Many AI services reserve the right in consumer plans to use inputs to improve their models. The exclusion must be in the contract, not only in a setting that someone can reset. Also get a commitment on how long inputs and outputs are kept at the provider, for example for abuse monitoring.

Retention and deletion

The index, the logs of questions and answers, caches and backups contain copies of your documents. Define when each copy is deleted and who confirms the deletion in writing. A person who exercises the right to erasure under Art. 17 GDPR must also disappear from the index.

When is a data protection impact assessment needed? (Art. 35 GDPR)

A data protection impact assessment (DPIA) is mandatory when the processing is likely to result in a high risk to the data subjects. With AI this is the case, for example, when employees are systematically evaluated, when special categories under Art. 9 GDPR such as health data are processed on a large scale, or when a new technology combines many data sources. The German supervisory authorities publish a list of processing operations for which a DPIA is always required. A knowledge assistant for work instructions usually needs no DPIA; an assistant that evaluates personnel files very probably does.

Involve the data protection officer and the works council

In Germany a data protection officer must be appointed as soon as, as a rule, at least 20 persons are permanently engaged in the automated processing of personal data (Section 38 of the Federal Data Protection Act, BDSG). If the tool processes employee data, the works council has a co-determination right when the system is capable of monitoring behaviour or performance (Section 87(1) no. 6 of the Works Constitution Act, BetrVG). An intention to monitor is not required; capability is enough. Since 2021 the Works Constitution Act names artificial intelligence explicitly in the information and consultation rights (Section 90 BetrVG).

Transparency towards data subjects (Art. 13 and 14 GDPR)

Employees, customers and applicants must know that their data are processed with an AI system, for what purpose and by which provider. The privacy notices for employees and customers must be extended accordingly. This also applies when the data were not collected directly from the person (Art. 14 GDPR).

Access rights must continue to hold

An AI assistant must not show a person a document they could not open without the assistant. That sounds obvious, but it is the most common mistake: all documents go into one index, and the permissions of the file system are gone. The check must happen before the model reads, not afterwards in the answer. And the refusal “not found” must not differ from “not allowed”, or it reveals that a document exists.

Checklist: ten points before the first document

1. Purpose set down in writing, legal basis under Art. 6 GDPR named, and in the case of legitimate interest the balancing test documented.
2. Only the data sources connected that the purpose requires; personal details pseudonymised where possible.
3. For every processing step it is known where and at whose premises it takes place; the list of sub-processors is available.
4. Data processing agreement under Art. 28 GDPR concluded, with annexes on data, data subjects and technical and organisational measures.
5. For processing outside the EEA: adequacy decision or standard contractual clauses with an assessment; the status at the time of the decision recorded.
6. Training on your data and use for the provider's own purposes excluded by contract; retention period of inputs and outputs at the provider known.
7. Deletion deadlines for index, logs, caches and backups defined; deletion is confirmed in writing.
8. Checked and documented whether a data protection impact assessment under Art. 35 GDPR is needed; if so, carried out.
9. Data protection officer and, for employee data, works council involved before the decision; privacy notices under Art. 13 and 14 GDPR extended.
10. Access rights are checked before the model reads; a log of questions, accesses and actions exists and is readable for the data protection officer.

Three deployment options compared

How many points of the list can be met depends on where the tool runs and under which contract. Three typical options:

How Sovern builds this

Sovern Ask, our knowledge assistant, is at the pilot stage. The principles are fixed: the system runs on your servers or on servers that Sovern operates in Germany. You choose the model: Claude, Azure OpenAI or an open model on your own hardware; a cloud model is connected only with your written approval. Permissions are checked before a model reads a passage; what a person could not open is not searched. Every answer names the page and the quote it rests on. Your data are not used to train models, neither by Sovern nor, according to their contractual commitments, by the model providers. We offer a data processing agreement in every case, even when the system runs exclusively at your premises.

This article is general information and not legal advice. Before a decision, check with your data protection officer or legal adviser: the GDPR articles named here and how they apply to your case, the current status of the EU-US Data Privacy Framework, the supervisory authorities' lists for data protection impact assessments, the threshold for appointing a data protection officer under Section 38 BDSG, and the works council's co-determination rights under Sections 87 and 90 BetrVG.