GDPR-Compliant AI in Business: The Complete Checklist

AI tools have arrived in the German mid-market. From automated invoice processing to AI-powered customer service and marketing copy — the use cases are broad and the time savings real. What many businesses underestimate: as soon as personal data is involved, the GDPR applies in full — regardless of whether the AI provider is based in Europe or the United States.

This guide explains which GDPR obligations arise when deploying AI, how cloud AI compares to local alternatives from a data protection perspective, and what you must clarify before the first employee record or customer inquiry flows into an AI system. At the end you will find a practical checklist for your AI deployment.

Why AI and data protection require special attention

The GDPR protects personal data — any information relating to an identifiable natural person. Names, email addresses and phone numbers are obvious examples. Less obvious but legally equivalent: the content of customer conversations, employee performance data, contract details or even writing styles that allow inferences about a person. Whoever passes this data to an AI system is processing it under the GDPR.

AI systems introduce specific risks that traditional software does not. Many large language models were trained on vast datasets and can reproduce information — including data that was seemingly deleted or anonymised — in unexpected contexts. In addition, requests to cloud-based services flow to the provider's servers, often outside the EU. And decisions made or prepared by an AI system are subject to special requirements if they have legal or significant economic consequences for individuals.

Which AI applications are subject to GDPR?

Not every AI deployment automatically triggers complex data protection obligations. The decisive question is: are personal data being processed? Here is an overview of the most common scenarios in the mid-market:

• Customer and prospect communication: emails, chat logs, enquiries — almost always contain personal data. AI summaries, automated replies or CRM analysis are subject to GDPR.
• Human resources: application documents, performance reviews, attendance data. AI-assisted screening or analysis falls under Art. 22 GDPR (automated decisions).
• Accounting and invoice processing: invoices contain customer names and contact details — AI-driven extraction requires a processing basis.
• Transcription of meetings and calls: recordings of business conversations involve all participants. Clarify consent or legitimate interest.
• Internal knowledge bases and document search: often less critical if no customer data is included — but pay attention when handling personnel files or contract management.
• Marketing personalisation: customer behaviour, purchase history, segmentation — clarify the GDPR basis (consent or legitimate interest) and opt-out.

The six GDPR principles applied to AI

Article 5 GDPR defines six principles that apply to all processing of personal data — including AI. Here is what they mean in day-to-day AI use:

1. 1Lawfulness, fairness and transparency: every processing operation requires a legal basis (consent, contract, legitimate interest, etc.). Communicate AI use transparently — inform employees and customers when their data flows into AI systems.
2. 2Purpose limitation: data may only be used for the purpose for which it was collected. Customer data gathered for order fulfilment may not be used to train proprietary AI models without a fresh legal basis.
3. 3Data minimisation: only process the data actually needed. In practice: include as little context as possible in AI prompts; explore anonymisation or pseudonymisation.
4. 4Accuracy: regularly verify AI outputs that serve as a decision basis — hallucinations by language models are a real risk.
5. 5Storage limitation: regularly delete logs, chat histories and transcripts. For cloud services, check the provider's retention periods and implement your own deletion schedules.
6. 6Integrity and confidentiality: secure AI systems with appropriate technical and organisational measures (TOMs) under Art. 32 GDPR — access controls, encryption, logging.

Cloud AI vs. local AI: what data protection recommends

The biggest data protection decision lies in choosing between cloud-based AI (e.g. ChatGPT Enterprise, Microsoft Copilot 365) and locally operated open-weight models (e.g. on your own server or on-premise). Both approaches can be made GDPR-compliant — with different levels of effort:

For most SMEs, cloud AI with an Enterprise plan and training disabled is the pragmatic path. Those processing particularly sensitive data (health, finance, personnel records) or subject to specific compliance requirements should evaluate AI integration based on a local model.

GDPR checklist: what to clarify before deploying AI

This checklist applies to every new AI application that processes personal data — regardless of whether it is a purchased SaaS tool or a custom-developed solution:

• Define the legal basis: under which ground (Art. 6 GDPR) are data processed? Consent, contract performance or legitimate interest must be determined and documented before deployment.
• Sign a Data Processing Agreement (DPA): if an external service processes personal data on your behalf, a DPA under Art. 28 GDPR is mandatory — even for free-tier services.
• Check third-country transfers: is the server outside the EU/EEA? If so, Standard Contractual Clauses (SCCs) and, where applicable, an EU Commission adequacy decision must be in place.
• Disable training usage: for cloud-based AI services, ensure inputs are not used to train the provider's model. This typically requires an Enterprise plan or an active opt-out.
• Fulfil information obligations: inform employees, customers and, where relevant, suppliers that their data flows into AI systems (Art. 13/14 GDPR). Update the privacy policy and the employee handbook.
• Update the Record of Processing Activities (RoPA): add each new AI application as a separate processing activity (Art. 30 GDPR). Include the provider name, data categories, purpose, third-country transfers and deletion periods.
• Assess the need for a Data Protection Impact Assessment (DPIA): for high-risk processing (automated decisions with legal effect, large-scale processing of special categories, systematic monitoring), a DPIA under Art. 35 GDPR is mandatory — not optional.
• Define technical and organisational measures (TOMs): who has access to AI outputs and logs? How is data stored, encrypted and deleted? Document the answers.
• Safeguard data subject rights: can customers and employees exercise their right of access, rectification or erasure with respect to data held in AI systems? Set up internal processes for this.

EU AI Act: what SMEs need to know now

The EU AI Act (Regulation (EU) 2024/1689) supplements the GDPR with specific requirements for AI systems and has applied in parts since August 2026. Most standard AI tools — writing assistants, chatbots, translation tools — fall into the general AI model or low-risk AI category and face comparatively limited obligations (transparency labelling for deepfakes and AI-generated content). Higher requirements apply to so-called high-risk AI under Annex III of the Regulation:

• High-risk AI in the SME context concerns mainly: AI-assisted personnel decisions (candidate screening, performance evaluation), creditworthiness assessments, biometric systems, AI in critical infrastructure and education.
• Obligations for high-risk AI: risk management system, technical documentation, conformity assessment, CE marking, registration in the EU database — considerably more demanding than for low-risk AI.
• Prohibited AI practices (from August 2026): social scoring, subliminal manipulation, exploitation of vulnerabilities, real-time biometrics in public spaces (with narrow exceptions).
• New transparency obligation: deepfakes and AI-generated texts, images or videos with substantial resemblance to real persons or events must be labelled as AI-generated.
• Recommendation for SMEs: conduct a brief AI inventory — which tools am I using, and what risk category do they fall into? For standard office applications, the GDPR checklist is usually sufficient; the high-risk assessment only becomes relevant for HR AI or credit scoring systems.

Common GDPR mistakes in AI deployment — and how to avoid them

In practice, the same pitfalls appear repeatedly in SMEs — regardless of company size or sector:

• No DPA before the first input: employees use the free tier of an AI service and enter customer data — without a DPA, this is a personal data breach. Fix: a clear internal policy on which tiers and which data are permitted.
• "The T&Cs cover it": general terms and conditions do not replace a DPA. The DPA is a separate document under Art. 28 GDPR — check whether the provider supplies one.
• Standard tier instead of Enterprise: many free or low-cost plans permit the provider to use inputs for model training. Enterprise or Business plans disable this — verify and document it in the RoPA.
• No deletion schedules for AI logs: AI chat histories and transcripts are stored indefinitely. Implement deletion periods as you would for emails and documents.
• AI decisions without human oversight: for decisions with significant effects on individuals (personnel selection, credit decisions), Art. 22 GDPR requires the right to human review. Fully automated decisions are unlawful without consent.
• Overlooking a DPIA: organisations launching a new AI project for high-risk areas without a DPIA treat it as a formality — until the data protection authority asks questions.

GDPR-compliant AI integration: practical next steps

GDPR and AI are not mutually exclusive — they require diligence. Working systematically through the checklist in this article allows you to deploy AI tools in a GDPR-compliant manner and demonstrate internally that you are meeting your accountability obligation under Art. 5(2) GDPR. Based on experience, the initial effort for a first AI project with a clean data protection setup is around two to four working days — spread across the DPA, RoPA update, employee communication and, where necessary, the DPIA.

If you are deploying multiple AI systems simultaneously or particularly sensitive areas (HR, health, finance) are involved, a structured AI and IT advisory engagement is worthwhile — to set up the framework correctly once, rather than starting from scratch with every new tool.

Frequently asked questions

Do SMEs need to sign a Data Processing Agreement for ChatGPT, Copilot etc.?

Yes, as soon as personal data is entered. Microsoft (Copilot), OpenAI (ChatGPT Enterprise) and Google (Gemini for Workspace) provide standardised DPAs that must be signed before using the service with company data. Free or personal plans often lack a DPA — company or customer data should not be entered there.

May employee data be entered into AI systems?

In principle yes, if there is a GDPR legal basis (often: contract performance or legitimate interest), a DPA with the provider is in place, and training usage is disabled. Exercise caution with special category data (health, disability, trade union membership — Art. 9 GDPR), for which stricter rules apply, and with decisions that have significant effects (Art. 22 GDPR).

When is a Data Protection Impact Assessment (DPIA) mandatory for AI projects?

Article 35 GDPR requires a DPIA when processing is likely to result in a high risk. Particularly relevant for AI projects: automated decisions with legal or significantly adverse effects (staff selection, credit decisions), large-scale processing of special category data, systematic monitoring of public areas. When in doubt: a DPIA conducted unnecessarily is less harmful than no DPIA and a regulatory reprimand.

Are open-weight AI models automatically GDPR-compliant?

Not automatically. Locally operated models avoid third-country transfers and the training risks of cloud services — a significant advantage. But GDPR obligations (purpose limitation, data minimisation, technical safeguards, documentation) still apply. No DPA is needed (data does not leave the company), but the RoPA, TOMs and, where applicable, the DPIA remain mandatory.

How does the EU AI Act change our GDPR obligations?

The EU AI Act adds to existing obligations; it does not replace the GDPR. For standard AI tools (writing assistants, chatbots), the GDPR remains the primary framework; the Act mainly requires transparency labelling for synthetic content. Only for high-risk AI under Annex III (HR, credit, infrastructure) do additional obligations apply (risk management, CE marking, conformity assessment). A brief AI inventory — which tools are we using, and which risk category do they belong to — helps estimate the actual compliance effort.

Must customers be informed when their query is handled by AI?

Yes, from two directions: the GDPR requires transparency about processing activities (Art. 13), meaning the privacy policy must describe AI use and the associated data processing. The EU AI Act additionally requires that users know when they are interacting with an AI system (chatbots, voice assistants) — unless it is obvious to a reasonable person.

GDPR-compliant AI use is not a project you complete — it is an ongoing practice of checklists, updates and occasional adjustments. Once you have a clean setup in place, you no longer need legal counsel for every new tool test.

Do you have questions about GDPR-compliant AI integration in your business or need support setting up an appropriate AI framework? We guide SMEs in Bavaria and the DACH region through structured AI deployment — from the initial assessment to productive operation.

This article was created with AI assistance and editorially reviewed.