GDPR and artificial intelligence: how to protect your customers’ data when using AI in your business

Using AI does not exempt you from data protection obligations; it reinforces them. We explain what the GDPR says about using personal data in AI projects, when you need a DPIA, which legal bases are valid, and how to avoid the mistakes that can lead to a fine.

If your company uses artificial intelligence (a chatbot,a recommendation engine, a predictive analytics system, or simply ChatGPT to write emails), you are processing data. And if that data belongs to people (customers, employees, suppliers), the GDPR applies. There are no exceptions because you are an SME, because you use cloud AI, or because the data is supposedly “anonymous” when it is actually pseudonymized.

The General Data Protection Regulation (GDPR) is the backbone of all European digital regulation. The AI Act, NIS2, and the DSA all rely on GDPR principles. This has a very practical meaning: an AI project that does not comply with the GDPR will never be able to demonstrate compliance with the AI Act.

In this article, we explain the intersection of GDPR and AI in practical terms: which of your customers’ rights you must respect, when you need a data protection impact assessment (DPIA), which legal bases you can use, what your contract with an AI provider must include, and the mistakes we see most often.

AI and personal data: what the GDPR says

The GDPR does not explicitly mention artificial intelligence (it was approved in 2016, before the generative AI boom), but its principles apply directly to any system that processes personal data:

• Lawfulness, fairness, and transparency: You must have a legal basis for each data processing activity, inform data subjects about how you use their data, and not use it in ways they would not expect.
• Purpose limitation: Data collected for one purpose cannot be reused for an incompatible purpose. If you collect emails to send invoices, you cannot use them to train a behaviour-prediction model without an additional legal basis.
• Data minimization: You may process only the data that is strictly necessary. If your chatbot does not need the customer’s full name to answer a shipping question, do not ask for it.
• Accuracy: Data must be up to date and correct. An AI system trained on outdated or incorrect data produces incorrect results —and that has legal consequences.
• Storage limitation: You cannot store data indefinitely. Define clear retention periods (for example, 90 days for pilot data) and delete it at the end.
• Integrity and confidentiality: Encryption, least-privilege access control, segregated environments (development, testing, production), and access logs.

In addition, the GDPR recognizes seven fundamental rights of citizens that apply directly when you use AI:

• Right of access and transparency: The customer can ask you to explain what data you hold about them and how you use it.
• Right to rectification: If the data is incorrect, you must correct it.
• Right to erasure: The customer can ask you to delete their data. In AI, this is especially complex: if their data was part of a model’s training, removing it may require complete retraining.
• Right to object: The customer can object to the processing of their data, especially when it is based on legitimate interest.
• Right not to be subject to automated decision-making: Article 22 of the GDPR. If your AI system makes decisions with significant effects on a person (approving credit, filtering a CV, denying a service) without human intervention, the data subject has the right to challenge it and demand human review.

An AI project that does not comply with the GDPR will never be able to demonstrate compliance with the AI Act.

When you need a DPIA (and when a DPIA-Lite is enough)

The Data Protection Impact Assessment (DPIA) is the mechanism the GDPR establishes to assess the risks that data processing may pose to people’s rights and freedoms. Not every AI project requires one, but many do.

When is it mandatory?

A DPIA is mandatory when data processing involves a high risk to people’s rights. In the context of AI, this includes:

• Large-scale profiling or automated decisions: Credit approval, hiring, academic assessment, and justice.
• Processing sensitive data: Health data, biometrics, emotions, sexual orientation, and religious beliefs.
• Systematic monitoring: Continuous monitoring of people in public or workplace spaces.
• Large-scale processing: Significant data volumes or numbers of affected people.

DPIA-Lite for pilots

In the methodology we use at Impulsa3, for pilots with a limited scope (limited data, defined duration, controlled population), we use a DPIA-Lite: a simplified but equally rigorous version that covers the essential fields without the complexity of a full DPIA.

A DPIA-Lite includes:

1. Processing identification: Which system, who the sponsor is, who the Product Owner is, who the DPO is, which entity is responsible, and which providers process data.
2. Description and purpose: What the system does, which decision it supports, why it is necessary and proportionate.
3. Legal basis: Which of the six legal bases in Article 6 of the GDPR applies (consent, contract, legal obligation, vital interest, public interest, legitimate interest).
4. Data categories and affected people: Which personal data is processed (contact, transactional, browsing), whether there are special categories (Article 9), and which populations are affected.
5. Data flows and transfers: Where data comes from, where it goes, which subprocessors are involved, and whether there are international transfers.
6. Minimization and retention: Only necessary data, retention limited to the pilot (for example, 90 days), and deletion at the end.
7. Security: Least-privilege access control, segregated environments, logs, and an incident plan with notification deadlines (72 hours under the GDPR).
8. Risk assessment: Identification of risks by probability and impact (1–5 scale), mitigation measures, and residual risk.
9. Conclusion and sign-off: Decision (limited risk → may proceed to Gate 1; moderate risk → mitigate first; high risk → redesign) with approval from Legal/DPO, Security, and the Product Owner.

Important: The DPIA-Lite is not a shortcut to avoid the full DPIA. It is a tool for limited-scope pilots. If the system moves into production with an expanded scope, sensitive data, or significant effects, you will need to complete the standard DPIA.

Legal bases for AI projects: which one applies in each case

Every processing of personal data needs a legal basis under Article 6 of the GDPR. In AI projects, the three most common are:

1. Consent (Art. 6.1.a)

The data subject gives explicit and informed consent. It is the strongest legal basis, but also the most fragile operationally: consent must be freely given, specific, informed, and unambiguous. And it can be withdrawn at any time.

When to use it: When processing sensitive data (Article 9), when processing is not strictly necessary for the service, or when you want a strong legal basis before the authorities.

2. Performance of a contract (Art. 6.1.b)

Processing is necessary to perform a contract with the data subject or to take pre-contractual steps at their request.

When to use it: A chatbot that accesses order history to resolve a complaint. A recommendation engine that personalizes the shopping experience as part of the contracted service.

3. Legitimate interest (Art. 6.1.f)

Processing is necessary for a legitimate interest of the company, provided that the data subject’s rights do not override it. It requires a balancing test: demonstrating that your commercial interests do not outweigh your customers’ privacy rights.

When to use it: Fraud detection, security analysis, and internal process optimization. It is the most common basis in AI projects, but also the most debated.

Advice: Always document the legal basis chosen in the DPIA and classification record. If you use legitimate interest, also document the balancing test. “It seemed reasonable to us” is not evidence.

Your AI provider contract: what the DPA must include

If you use an external AI service (Tidio, Gorgias, ChatGPT API, Shopify Magic, or any AI SaaS), you are outsourcing the processing of personal data. The GDPR requires you to have a signed Data Processing Agreement (DPA) before giving access to any data.

An DPA for AI services must include at least:

• Use restrictions: Explicitly prohibit the provider from using your customers’ data for training, improvement, or its own benefit, unless there is an express agreement and clear legal basis.
• Technical annexes: Logging scheme for traceability, environment segregation, and evidence of technical controls (encryption, minimum access).
• Subprocessor management: Which subcontractors process data, where they are located, and the legal basis for international transfers.
• Reversibility clause: Your ability to migrate data if you change providers. Without this clause, you are locked in.
• Incident notification: Notification deadlines (the GDPR requires 72 hours), communication protocol, and responsibilities.
• Deletion clause: What happens to the data when the contractual relationship ends: certified deletion or return.

Before signing: Always request the provider’s technical factsheet and confirm availability and response-time SLAs. A serious provider will have no problem supplying this information.

The five most common mistakes (and how to avoid them)

1. Assuming that data is anonymous. Pseudonymization is not anonymization. If data can be reidentified (through cross-referencing, context, or inference techniques), it remains personal data and the GDPR applies. AI is especially powerful at inferring sensitive data from apparently harmless data: browsing patterns can reveal health status, sexual orientation, or financial situation.
2. Not having a signed DPA with the AI provider. Using an AI API with customer data without a DPA is a direct GDPR violation. The risk is not theoretical: if the provider uses that data to train its model, your customers are exposed without a legal basis.
3. Reusing data for unplanned purposes. You collect purchase data for billing and use it to train a predictive behaviour model. Without an additional legal basis (specific consent or legitimate interest documented with a balancing test), this is a violation.
4. Having no mechanism for exercising rights. If a customer requests access to, rectification of, or deletion of their data, you need an operational process to handle the request within the deadline (one month maximum). If your AI is in a third party’s cloud, the DPA must cover how to execute these rights.
5. Ignoring automated decisions. If your AI system makes decisions with a significant effect on people (service denial, application rejection, credit score) without effective human intervention, you are violating Article 22. HITL (Human-in-the-Loop) is not optional in these cases.

Practical GDPR compliance checklist for AI projects

Use this checklist before launching any AI project that processes personal data:

• Documented legal basis for every processing activity in the project.
• Completed DPIA (or DPIA-Lite for a limited-scope pilot) signed by Legal/DPO.
• Signed DPA with every external provider that processes personal data.
• No-training clause in the DPA: the provider may not use your data to improve its model.
• Minimization policy applied: only the data necessary for the purpose.
• Defined retention period and automatic deletion mechanism at the end.
• Transparency notice implemented: the user knows they are interacting with AI and what data is processed.
• Rights mechanism operational: access, rectification, erasure, objection, and portability.
• Human oversight designated when there are automated decisions with significant effects.
• Access control based on least privilege (SSO/MFA) and segregated environments.
• Incident plan with contacts, deadlines (72 hours), and notification protocol.
• Access and query logs enabled with basic alerts.

Golden rule: If you cannot demonstrate with evidence that you meet every point, you are not compliant. The GDPR requires accountability (proactive responsibility): it is not enough not to violate the rules; you must be able to demonstrate compliance.

The GDPR as an advantage, not an obstacle

Complying with the GDPR in your AI projects is not only about avoiding fines (which can reach €20 million or 4% of global turnover). It is about building a foundation of trust with your customers, a clean data infrastructure that improves AI quality, and a governance model that prepares you automatically for the AI Act.

Data preparation represents between 60% and 80% of the budget of any AI project. If that preparation includes data quality, minimization, traceability, and GDPR controls from day one, you are not adding cost: you are doing properly the work you would have had to do anyway.

If you need help preparing your AI project’s DPIA, reviewing DPAs with your providers, or implementing the data governance model that connects GDPR, the AI Act, and operations, Impulsa3 can support you from classification through production.

Data protection should be complemented by data quality for AI projects.