Is generative AI compatible with the GDPR?

Generative AI does not create new rules on personal data: the GDPR applies as it does to any processing. You need a clear purpose, a legal basis, data limited to what is necessary, information for the people concerned and safeguards when data is processed outside the European Union.

What complicates matters is improvised use. Meeting minutes that name colleagues, a customer file summarised by a free tool, an application analysed by an assistant: so many processing operations on personal data that nobody has declared or framed. The CNIL, the French data protection authority, has published recommendations on AI that help set this framework.

• Personal data is everywhere.Emails, minutes, contracts and customer requests almost always contain some.
• Where data is processed is rarely checked.Many tools process data outside Europe, with varying safeguards.
• The record of processing activities often ignores AI.Uses that have appeared within teams do not feature in it.

1. 01Involve your data protection officer, or the person in charge of these matters, as soon as you choose a tool.
2. 02For each tool, check where data is processed and what the supplier can do with it.
3. 03Enter your AI uses in your record of processing activities, with their purpose.

We help set a clear framework from the start, with your advisers and your data protection officer.

• Is our data safe with generative AI?→
• What does the EU AI Act change for our company?→
• Should we host our own models or use a major provider?→
• Should we tell our customers they are talking to an AI?→