GDPR and Artificial Intelligence: How to Protect Your Customers' Data When Using AI in Your Business

Using AI does not exempt you from complying with data protection, it reinforces it. We explain what the GDPR says about the use of personal data in AI projects, when you need a DPIA, which legal bases are valid, and how to avoid the errors that can result in penalties

Si tu empresa usa inteligencia artificial (un chatbot,a recommendation engine, un sistema de análisis predictivo, o simplemente ChatGPT para redactar emails), estás procesando datos. Y si esos datos son de personas (clientes, empleados, proveedores), el RGPD aplica. No hay excepciones por ser pyme, ni por usar IA en la nube, ni por tratarse de datos «anónimos» que en realidad son pseudoanonimizados.

The General Data Protection Regulation (GDPR) is the backbone of all European digital regulation. The AI ActNIS2, the DSA—all rest on GDPR principles. This means something very practical: an AI project that does not comply with the GDPR will never be able to demonstrate compliance with the AI Act..

In this article we explain the intersection between GDPR and AI in practical terms: what rights of your customers you must respect, when you need an impact assessment (DPIA), which legal bases you can use, what must be included in your contract with your AI provider, and the errors we see most frequently.

AI and Personal Data: What the GDPR Says

El RGPD no menciona explícitamente la inteligencia artificial (fue aprobado en 2016, antes del boom de la IA generativa), pero sus principios aplican directamente a cualquier sistema que procese datos personales:

• Licitud, lealtad y transparency: You must have a legal basis for each data processing activity, inform the data subjects of how you use their data, and not use it in ways they would not expect.
• Purpose limitation: Data collected for one purpose cannot be reused for another incompatible purpose. If you collect emails to send invoices, you cannot use them to train a behavior prediction model without an additional legal basis.
• Data minimization: You may only process data that is strictly necessary. If your chatbot does not need the customer's full name to answer a question about shipments, do not ask for it.
• Accuracy: Data must be up-to-date and correct. An AI system trained with obsolete or incorrect data produces incorrect results—and that has legal consequences.
• Storage limitation: You cannot store data indefinitely. Define clear retention periods (for example, 90 days for pilot data) and delete upon closure.
• Integrity and confidentiality: Encryption, least privilege access control, segregated environments (development, test, production), access logs.

In addition, the GDPR recognizes seven fundamental rights of citizens that apply directly when you use AI:

• Right of access and transparency: The customer can ask you to explain what data you have about them and how you use it.
• Right of rectification: If the data is incorrect, you must correct it.
• Right to be forgotten: The customer can request deletion of their data. In AI, this is especially complex: if their data was part of model training, removing it may require complete retraining.
• Right to object: The customer can object to the processing of their data, especially if based on legitimate interest.
• Right not to be subject to automated decisions: Article 22 of the GDPR. If your AI system makes decisions with significant effects on a person (approving a loan, filtering a CV, denying a service) without human intervention, the data subject has the right to challenge it and demand human review.

An AI project that does not comply with the GDPR will never be able to demonstrate compliance with the AI Act.

When You Need a DPIA (and When a DPIA-Lite Is Enough)

The Data Protection Impact Assessment (DPIA) is the mechanism the GDPR establishes to evaluate the risks that data processing may pose to the rights and freedoms of individuals. Not all AI projects require it, but many do.

When Is It Mandatory?

A DPIA is mandatory when data processing involves high risk to the rights of individuals. In the context of AI, this includes:

• Large-scale profiling or automated decisions: Loan approval, hiring, academic evaluation, justice.
• Processing of sensitive data: Health data, biometrics, emotions, sexual orientation, religious beliefs.
• Systematic monitoring: Continuous monitoring of people in public or workplace spaces.
• Large-scale processing: Volume of data or number of affected individuals is significant.

DPIA-Lite for Pilots

In the methodology we use at Impulsa3, for pilots with limited scope (limited data, defined duration, controlled population), we use a DPIA-Lite: una versión simplificada pero igualmente rigurosa que cubre los campos esenciales sin la complejidad de una DPIA completa.

Una DPIA-Lite incluye:

1. Identification of processing: What system, who is the sponsor, who the Product Owner, who the DPO, what entity is responsible, and what providers process data.
2. Description and purpose: What the system does, what decision it supports, why it is necessary and proportionate.
3. Legal basis: Which of the six bases of Article 6 of the GDPR applies (consent, contract, legal obligation, vital interest, public interest, legitimate interest).
4. Categories of data and affected individuals: What personal data is processed (contact, transactional, navigation), whether there are special categories (Article 9), and what populations are affected.
5. Data flows and transfers: Where the data comes from, where it goes, what sub-processors are involved, and whether there are international transfers.
6. Minimization and retention: Only necessary data, retention limited to the pilot (for example, 90 days), deletion upon closure.
7. Security: Least privilege access control, segregated environments, logs, incident plan with notification timelines (72 hours per GDPR).
8. Risk assessment: Risk identification with probability and impact (scale 1-5), mitigation measures, and residual risk.
9. Conclusion and signature: Decision (limited risk → can proceed to Gate 1; moderate risk → mitigate first; high risk → redesign) with approval from Legal/DPO, Security, and Product Owner.

Important: DPIA-Lite is not a shortcut to avoid the full DPIA. It is a tool for bounded pilots. If the system moves to production with expanded scope, sensitive data, or significant effects, you will need to complete the standard DPIA.

Legal Bases for AI Projects: Which Applies in Each Case

All personal data processing requires a legal basis from Article 6 of the GDPR. In AI projects, the three most common are:

1. Consent (Art. 6.1.a)

The data subject gives explicit and informed consent. It is the most legally robust basis, but also the most operationally fragile: consent must be free, specific, informed, and unambiguous. And it is revocable at any time.

When to use it: When you process sensitive data (Article 9), when processing is not strictly necessary for the service, or when you want a solid legal basis before the authority.

2. Contract Execution (Art. 6.1.b)

Processing is necessary to fulfill a contract with the data subject or to take pre-contractual measures at their request.

When to use it: A chatbot that accesses order history to resolve a claim. A recommendation engine that personalizes the shopping experience as part of the contracted service.

3. Legitimate Interest (Art. 6.1.f)

Processing is necessary for a legitimate interest of the company, provided that the rights of the data subject do not prevail. It requires a balancing test: demonstrating that your business interests do not outweigh your customers' privacy rights.

When to use it: Fraud detection, security analysis, internal process optimization. It is the most common basis in AI projects, but also the most debated.

Tip: Always document the chosen legal basis in the DPIA and in the classification record. If you use legitimate interest, also document the balancing test. 'It seemed reasonable to us' is not evidence.

Your Contract with Your AI Provider: What the DPA Must Include

If you use an external AI service (Tidio, Gorgias, ChatGPT API, Shopify Magic, any SaaS with AI), you are outsourcing personal data processing. The GDPR requires that you have a signed Data Processing Agreement (DPA) antes de dar acceso a cualquier dato.

Un DPA para servicios de IA debe incluir como mínimo:

• Limitation of uses: Explicitly prohibit the provider from using your customers' data for training, improvement, or its own benefit, unless there is express agreement and clear legal basis.
• Technical annexes: Logging scheme for traceability, environment segregation, evidence of technical controls (encryption, minimum access).
• Sub-processor management: What subcontractors process data, where they are located, legal basis for international transfers.
• Reversibility clause: Your ability to migrate data if you change providers. Without this clause, you are locked in.
• Incident notification: Notification timelines (GDPR requires 72 hours), communication protocol, and responsibilities.
• Deletion clause: What happens to data when the contractual relationship ends: certified deletion or return.

Before signing: Always request the provider's technical fact sheet and confirm availability SLAs and response time. A serious provider will not have a problem providing this information.

The Five Most Common Errors (and How to Avoid Them)

1. Assuming data is anonymous. Pseudonymization is not anonymization. If data can be re-identified (through linkage, context, or inference techniques), it remains personal data and the GDPR applies. AI is especially powerful at inferring sensitive data from apparently innocuous data: browsing patterns can reveal health status, sexual orientation, or financial situation.
2. Not having a signed DPA with your AI provider. Using an AI API with customer data without a DPA is a direct GDPR violation. And the risk is not theoretical: if the provider uses that data to train its model, your customers are exposed without legal basis.
3. Reusing data for unplanned purposes. You collect purchase data for billing and use it to train a predictive behavior model. Without an additional legal basis (specific consent or documented legitimate interest with balancing test), it is a violation.
4. Not having a mechanism to exercise rights. If a customer requests access to their data, rectification, or deletion, you need an operational process to handle that request on time (maximum one month). If your AI is in a third party's cloud, the DPA must address how to execute these rights.
5. Ignoring automated decisions. If your AI system makes decisions with significant effect on people (service denial, request rejection, credit score) without effective human intervention, you are violating Article 22. HITL (Human-in-the-Loop) is not optional in these cases.

Practical GDPR Compliance Checklist for AI Projects

Use this checklist before launching any AI project that processes personal data:

• Documented legal basis for each data processing in the project.
• DPIA completed (or DPIA-Lite if it is a bounded pilot) and signed by Legal/DPO.
• DPA signed with each external provider that processes personal data.
• No-training clause in the DPA: the provider cannot use your data to improve its model.
• Minimization policy applied: only the data necessary for the purpose.
• Defined retention period and automatic deletion mechanism upon closure.
• Transparency notice implemented: the user knows they are interacting with AI and what data is processed.
• Operational rights mechanism access, rectification, deletion, objection, portability.
• Human oversight designated if there are automated decisions with significant effect.
• Access control by least privilege (SSO/MFA) and segregated environments.
• Incident plan with contacts, timelines (72h), and notification protocol.
• Access and query logs enabled with basic alerts.

Golden rule: If you cannot demonstrate with evidence that you comply with each point, you are not complying. The GDPR requires accountability (proactive responsibility): it is not enough to not violate, you must be able to demonstrate compliance.

GDPR as an Advantage, Not an Obstacle

Complying with the GDPR in your AI projects is not just about avoiding penalties (which can reach 20 million euros or 4% of global turnover). It is about building trust with your customers, a clean data infrastructure that improves the quality of your AI, and a governance model that automatically prepares you for the AI Act.

Data preparation represents between 60% and 80% of the budget for any AI project. If that preparation includes from day one the quality, minimization, traceability, and controls of the GDPR, you are not adding cost: you are doing well the work you would have to do anyway.

If you need help preparing the DPIA for your AI project, reviewing DPAs with your providers, or implementing the data governance model that connects GDPR, AI Act, and operations, at Impulsa3 we support you from classification to production.

La protección de datos debe complementarse con calidad de datos para proyectos de IA.