Guide
Is AI compatible with GDPR?
For a firm that feeds customer or employee data into AI tools, the GDPR, in force since 25 May 2018, is usually the closer risk. Four checks do most of the work.
First check: the legal basis
Feeding personal data into ChatGPT, Copilot or an internal tool is processing, and processing needs a legal basis under Art. 6(1): consent, necessity for a contract, legal obligation, vital interests, public task, or legitimate interests. Pick one per use case and write it down.
Legitimate interest is not a rubber stamp. Under the European Data Protection Board's Opinion 28/2024 of 17 December 2024, it cannot serve as a default basis for training or using AI models on personal data. Anyone relying on it must run and document a three-step test: identify the interest, assess necessity, and balance it against the rights of the data subjects.
Second check: the DPIA trigger
A data protection impact assessment is mandatory before processing starts whenever the processing, in particular using new technologies, is likely to result in high risk to individuals' rights and freedoms.
Art. 35(3) names three triggers: systematic and extensive evaluation or profiling with automated decisions producing legal or similarly significant effects, large-scale processing of special-category or criminal-record data, and systematic large-scale monitoring of public areas. Automated applicant screening and automated credit or risk scoring are the classic SMB cases.
Third check: the human decision point
Art. 22 gives individuals the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them. The picture: an AI tool auto-rejecting a loan or a job application with no human involved.
Three narrow exceptions exist: necessity for a contract, authorised by law, explicit consent. Each requires safeguards: the right to obtain human intervention, to express a view, and to contest the decision. For every use that scores, ranks or decides about people, name the person who reviews before the decision takes effect, and give them actual power to change it.
Fourth check: data going to the US
When your AI provider processes personal data outside the EU and EEA, US-hosted ChatGPT, Claude or Copilot infrastructure for instance, GDPR Chapter V requires an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Most US-hosted AI vendors rely on the EU-US Data Privacy Framework, the Commission's July 2023 adequacy decision.
That framework is legally valid as of this writing. Treat it as a live question, not a settled one. The EU General Court upheld it in September 2025, an appeal is pending before the Court of Justice with no hearing date set, and on 31 July 2026 the EDPB wrote to the Commission asking it to examine whether a US Supreme Court ruling of 29 June 2026 undermines the independent-oversight premise the adequacy decision relies on.
The practical stance: know which of your vendors lean on the framework, and check whether Standard Contractual Clauses are available as a fallback in their terms. The check costs an hour.
Copilot, ChatGPT and similar tools
Using a general-purpose tool as supplied, without putting a new AI system into service under your own name, keeps you a deployer. The vendor is the provider and carries the model-level duties. You become a provider when you build your own system and put it into service under your own name, an API-based internal tool for example.
The conference of German data protection authorities, the DSK, has issued a practical checklist for selecting, implementing and using AI in a data-protection-compliant way, first issued 6 May 2024 and updated in June 2025. It is guidance from the authorities that enforce the GDPR, not an AI Act duty. Work through it per tool when personal data is in play.
- Legal basis: pick and write down one Art. 6(1) basis per use case.
- DPIA trigger: answer the three trigger questions for every processing activity that touches personal data.
- Human: for every scoring use, name the person who reviews and give them real power.
- Transfer: read each vendor's transfer basis and calendar the framework question as open.
Related: AI literacy has been a duty on every deployer since 2 February 2025. What counts as a measure is in the guide AI training for employees. What AI consulting costs is in What does AI consulting cost?.
Frequently asked questions
Is AI compatible with GDPR?
Yes, where the processing has a legal basis. Four checks do most of the work: a legal basis for every data flow, the DPIA trigger, a genuine human decision point, and a transfer basis for vendors outside the EU.
Is legitimate interest enough as a legal basis?
No, not by default. Under EDPB Opinion 28/2024, legitimate interest cannot serve as a default basis for training or using AI models on personal data. It needs a documented three-step test: identify the interest, assess necessity, balance it.
When do I need a data protection impact assessment?
When the processing is likely to result in high risk to individuals' rights and freedoms, and before processing starts. The classic SMB cases are automated applicant screening and automated credit or risk scoring.
Is the EU-US Data Privacy Framework safe?
It is legally valid as of this writing, but it is a live question. The EU General Court upheld it in September 2025 and an appeal is pending. In July 2026 the EDPB raised concerns about a US Supreme Court ruling. Check whether your vendors offer Standard Contractual Clauses as a fallback.
Free, 20 minutes, no sales pitch.
Last updated:
This guide is not legal advice.