Skip to content
NL Plan a start sprint

Compliance and security

AI and the GDPR: what to arrange before you use personal data

David Homan · 3 min read

The short answer

As soon as personal data is in prompts, documents or training data, the GDPR simply applies. You need a legal basis, a data processing agreement with every party that processes the data, and a DPIA when the risk to the people involved is high. The AI Act comes on top of that and replaces nothing in the GDPR.

When does the GDPR apply to AI?

As soon as personal data passes through the system. That happens more often than you think:

  • a member of staff pastes a customer email with a name and address into an AI tool;
  • an assistant searches files, CVs or patient records;
  • an AI voice holds conversations with customers and transcribes them;
  • you use your own data to train or fine-tune a model.

In all those cases the ordinary rules of the GDPR apply. Using AI changes nothing about that.

The four things to arrange

1. A legal basis. Why may you use this data for this purpose? Usually that is the performance of a contract or a legitimate interest. Record the assessment.

2. Data minimisation. Use only what you need. Remove names and numbers from texts the model does not need to know, and do not keep outputs longer than necessary.

3. A data processing agreement. With every party that processes the data on your behalf: the builder, the hosting provider and the model provider. Check where the data is stored and whether the provider trains on it.

4. A DPIA when the risk is high. A data protection impact assessment is mandatory when processing is likely to result in a high risk to the people involved. Think of profiling, health data, monitoring employees or large-scale processing with new technology. In the Netherlands the Autoriteit Persoonsgegevens keeps a list of processing for which a DPIA is always required.

An example from healthcare: in the AI voice we built for Medux, customer calls pass through the system: who is calling, what about and which appointment gets booked. Calls are transcribed for quality and review. So you settle in advance which data the system needs, how long the transcripts are kept and who has access.

Where is the data?

Two things are often mixed up:

  • Calling a model: you send a question to a model and get an answer. The question may be logged by the provider.
  • Storing data: documents, conversations and outputs you keep in a database or search index.

For both: know where it is. Transfers outside the EU are only allowed on an appropriate basis, such as the EU-US Data Privacy Framework for American companies that have signed up to it. That framework is under legal pressure: the EU General Court upheld it in September 2025, and the appeal to the Court of Justice is still pending. On top of that, the US CLOUD Act can oblige American companies to hand over data, even when it is stored in Europe. For sensitive data, European hosting or your own server is the safest choice.

The GDPR and the AI Act side by side

GDPRAI Act
CoversPersonal dataAI systems
Applies whenPersonal data is processedAI is provided or used
CoreLegal basis, minimisation, rights of data subjectsRisk class, transparency, oversight, literacy
Assessment in advanceDPIA when the risk is highRisk management and documentation for high-risk AI
Supervision in the NetherlandsAutoriteit PersoonsgegevensBeing prepared; the AP gets a coordinating role

An AI application that uses personal data has to meet both. Read more about the AI Act in the AI Act.

What AI Heroes does here

In every build, privacy is part of the design: data minimisation, European hosting as an option, and logging with fixed retention periods. As the controller, you carry out the DPIA yourself. On request we supply the technical information you need for it: which data, where it is stored, how long it is kept and which suppliers are involved.

Our own assistant shows what that looks like: conversations pseudonymised, kept for at most 30 days, and everything described on the transparency page.

Sources

Frequently asked questions

May I put customer data into ChatGPT?

Only with a legal basis, a business version with a data processing agreement and clear agreements about which data may go in. A free consumer account offers none of that, so you cannot justify it.

Do I need a DPIA for an AI application?

Often, yes. A DPIA is mandatory when processing is likely to result in a high risk, for example with profiling, health data, monitoring employees or large‑scale processing with new technology. Data protection authorities publish lists of processing for which a DPIA is always required; in the Netherlands that is the Autoriteit Persoonsgegevens.

Is an American AI provider GDPR compliant?

Transfers to the US are allowed under the EU‑US Data Privacy Framework if the provider has signed up to it. The EU General Court upheld that framework in 2025; an appeal to the Court of Justice is still pending. Separately, the CLOUD Act still applies. If you do not want that risk, choose European hosting.

May a model learn from our data?

Only if you allow it deliberately and there is a legal basis for it. In the business versions of most AI tools, training on customer data is off by default; check it in the terms and record it.

How long may you keep conversations with an AI assistant?

No longer than the purpose requires. Set a period per purpose. Our own assistant keeps conversations pseudonymised for at most 30 days, and contact details you leave yourself for at most 90 days.

Want to be sure your AI application is in line with the GDPR and the AI Act? Privacy is part of the design in every build, and the AI Act check shows you where you stand.

Go to compliance and security

Further reading