AI and data protection at work: what the GDPR requires

When does the GDPR apply to AI at work?

The GDPR applies to the automated processing of personal data (Art. 2(1)), whatever the tool; the protection is meant to be technologically neutral (recital 15). An AI assistant falls under it as soon as information about an identified or identifiable person goes in or comes out (Art. 4(1)).

That happens quickly. Your staff's accounts with the provider already contain personal data. And a question without names can produce an answer that refers to a person, as Germany's data protection authorities (DSK) note in their AI guidance of 6 May 2024 (para. 52).

Your company remains the controller because it decides on purpose and means (Art. 4(7)), and it must be able to demonstrate compliance (Art. 5(2)). Every processing step involving AI needs a legal basis (Art. 6(1); DSK para. 9).

Art. 2(1) · Art. 4(1) and (7) · Art. 5(2) · Art. 6(1) GDPR

What do you check with the AI provider?

If the AI runs in a provider's cloud, the DSK says the provider is often your processor, and you need a contract under Art. 28(3) GDPR, usually called a DPA (para. 32). You may use only providers that give sufficient guarantees (Art. 28(1)).

Find out whether inputs and outputs go into training and whether that can be excluded. The DSK prefers applications that do not use your data for training (para. 24).

If data goes to a country outside the EU, you need a basis under Art. 44 onwards, for example an adequacy decision (Art. 45) or the Commission's standard data protection clauses (Art. 46(2)(c)). Recipients and transfers belong in the record of processing activities (Art. 30(1)(d) and (e)) and in the privacy notice (Art. 13(1)(e) and (f)).

What the providers say (as of October 2026): OpenAI does not use data from ChatGPT Business, Enterprise and Edu for training by default; we could not read its data processing agreement. Anthropic acts as processor for Claude for Work and the API, and Microsoft does for Copilot as organisations use it. More in our articles on ChatGPT and on Claude.

Art. 28(1) and (3) · Art. 30(1) · Art. 44 to 46 GDPR

Which rules do your staff need?

The DSK assumes that in many companies staff use AI on their own initiative (para. 36). It recommends documented instructions on whether, under which conditions and for what purposes which AI application is allowed, ideally with examples. The GDPR requires steps so that staff process personal data only on instructions (Art. 32(4)).

Provide work accounts and devices so nobody has to work with a private account (para. 41). As a privacy-friendly default under Art. 25, the DSK names accounts whose inputs are not used for training and which keep no input history beyond the session (para. 43).

Deleting names is usually not enough, the DSK says, because the context can give the person away (para. 49). Results that refer to people must be checked before they are processed further (para. 65).

Involve the data protection officer, and check whether the works council should take part, where there is one (para. 31). In some cases, introducing an AI application triggers the works council's co-determination right, according to the DSK (para. 37).

Art. 25 · Art. 32(4) GDPR

When does AI need a data protection impact assessment?

Where processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of people, the controller assesses the impact beforehand (Art. 35(1)). For AI, the DSK expects this to be the case in many instances (para. 39).

The DSK's list of processing that requires a DPIA in the private sector, the “Muss-Liste”, expressly names AI that steers the interaction with data subjects or evaluates personal aspects (no. 11), for example a system that advises customers in conversation and processes their data.

Decisions with legal effect may in principle be taken only by people under Art. 22(1), and with real room to decide, the DSK writes (para. 12). It calls an AI that evaluates applications and sends the invitations itself an infringement (para. 13).

Art. 22(1) · Art. 35(1) GDPR

An example, and what often goes wrong

Kemper Lohse GmbH, a made-up maker of conveyor belts, finds that sales uses ChatGPT and engineering uses Claude, each on private accounts. It chooses one tool with a business contract, files the DPA and writes a usage rule.

HR may use AI for job ads but not for selecting applicants. For the planned chatbot on the website, the data protection officer checks whether a data protection impact assessment is needed.

Common mistakes are: having no rule, so staff use private accounts on their own; checking the provider but not updating the record and the privacy notice; and taking over results unchecked.

With an AI assistant

An assistant can draft the usage rule from your documents, compare a provider's DPA with Art. 28(3) and prepare an entry in the record for each AI tool.

Which tools are allowed, on which legal basis and whether a data protection impact assessment is needed is decided by your company with its data protection officer. Give the assistant policies and contracts for this, not personnel data, because its provider processes whatever it reads.

A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough. Through that server an AI assistant already enters information into the NIS 2 walkthrough today, with the rights of the person who connected it.