Checking that an AI tool complies with the GDPR: six questions

An AI tool often processes personal data: a customer’s name in a reminder, a CV, the notes of a meeting. As soon as that happens, the GDPR, the EU data protection regulation, applies. Before adopting a tool, ask the provider these six questions. The answers are usually in its privacy policy and its data processing agreement.

First reflex, whatever the tool: data minimisation. You may only use the data that is strictly necessary for the purpose. Often, a text without names or contact details is enough.

1. Where is the data hosted?

Find out which country the servers are in. Also ask from which countries the support team and sub-processors access the data. A transfer outside the European Union is possible, but it must be covered by safeguards, such as an adequacy decision or standard contractual clauses. Our guide AI tools and data in Europe explains this point in detail.

2. Is the data used to train the models?

Some free consumer plans may use your conversations to improve the models, with a setting that lets you opt out. Professional plans often rule this out in the contract. The CNIL, France’s data protection authority, recommends checking whether the provider can reuse the data you enter, and making sure you can object. Check tool by tool, and plan by plan.

3. Will the provider sign a data processing agreement?

When the provider processes data on your behalf, it is your processor under the GDPR. Article 28 then requires a contract, often called a DPA (data processing agreement). Among other things, this contract states that the provider acts on your documented instructions. It also commits the provider to keeping the data confidential and secure. Without a data processing agreement, do not put personal data into the tool.

4. Which sub-processors does it use?

A provider often relies on other companies: a host, a model provider, a support service. It cannot take on a new one without your prior written authorisation. This authorisation can be general: the provider must then tell you about planned changes, and you can object. Ask for the up-to-date list, with each company’s country.

5. How long is the data kept?

Personal data cannot be kept forever. Look for how long conversations and uploaded files are kept, and whether you can delete them yourself. At the end of the contract, the provider must delete the data or return it to you, as you choose.

6. How does it help you respect people’s rights?

Your customers, employees or job applicants can ask to access their data, correct it or have it erased. They can also object to its processing. The provider must help you, as far as possible, to answer these requests. Check that there is a clear procedure and a named contact.

What if the answers are missing?

A vague answer, or no answer at all, already tells you something. In that case, keep the tool for tasks without personal data: rewording a generic text, preparing the outline of a presentation.

Good answers from the provider are not enough on their own. On your side, you need a legal basis to use this data, and people must be informed. To compare quickly, the Index shows, for each tool, the hosting, the use of data for training and whether there is a data processing agreement.