AI tools and data in Europe: how to check

Three ideas not to confuse

“Hosted in the EU” is a common claim. It is useful, but it only answers part of the question.

A European provider can use a sub-processor outside the EU. A non-European provider can host the data in Europe. So you need to check all three points.

What the GDPR says about transfers

Transferring personal data outside the European Union is possible. A sufficient and appropriate level of protection must be ensured, using a legal tool. The main ones are:

• an adequacy decision: the European Commission recognises that a country protects data properly. For the United States, a decision of 10 July 2023 plays this role, under certain conditions;
• standard contractual clauses: model contracts adopted by the European Commission;
• binding corporate rules: internal rules that govern transfers within a group of companies.

Also think about access from abroad, for example for technical support. Ask whether it happens and how it is governed.

Providers subject to non-European law

The CNIL, France’s data protection authority, points out a risk for data stored by a company that is subject to non-European law. Such data may be exposed to a risk of having to be handed over to that country’s public authorities. The CNIL adds that this risk is usually considered limited for non-sensitive data entrusted to providers from countries recognised as “adequate”. For sensitive or strategic data, this point deserves more attention.

Where to look in a provider’s documentation

1. The privacy policy: where processing takes place, retention periods, use of data for training.
2. The data processing agreement (DPA): it governs the provider’s role as processor and sets out transfers and their safeguards.
3. The list of sub-processors: name, role and country of each company involved.
4. The security or compliance page: choice of hosting region, security measures, contact.
5. The terms of the plan: some safeguards only apply to professional plans.

Warning signs

• No mention of where the data is hosted.
• “Hosted in Europe” without a list of sub-processors.
• No data processing agreement available, or a request left unanswered.
• Transfers outside the EU with no mention of safeguards.
• Different terms for free and paid plans, without details.
• Documentation you cannot find, or that contradicts itself from one page to another.

In practice

For each tool in the Index, aidock shows whether the data is hosted in the EU. It also shows the use of data for training and whether there is a data processing agreement. The date of the check and the sources are displayed. This information can change: reread the provider’s documentation before you commit. For the other GDPR points, see our six questions.