What does the GDPR mean in the context of AI?

The General Data Protection Regulation protects personal data. This includes information that can be directly or indirectly attributed to a natural person, such as names, email addresses, phone numbers, customer data, employee data or job application documents.

Whenever such data is processed, questions arise, among other things, as to whether there is a legal basis for doing so, how long the data may be stored, who can access it and what rights the data subjects have.

Of course, this also applies when this data is processed using an AI system. The GDPR is therefore an important part of any AI strategy. But it is not the entire AI strategy.

Not all sensitive information is personal data

Much of a company's most valuable information does not fall directly under the GDPR. Examples include cost calculations, price lists, product ideas, manufacturing documents, source code, sales strategies, proposals, draft contracts, internal plans or financial figures.

This information can be enormously important to a company. Nevertheless, it is not automatically personal data.

This is precisely where a false sense of security often arises. A solution can be set up in compliance with data protection law and still pose a significant risk to confidential company information.

The key question is therefore not just:

Are we allowed to process this data?

But also:

Should we send this information to this service at all?

Data protection and data security are not the same thing

Data protection focuses on personal data. Data security concerns all information that needs to be protected.

This involves very practical questions:

• Where is the data processed?
• Who can access it?
• Who operates the technical infrastructure?
• Is content stored?
• Is it used for other purposes?
• Can it be used to train a model?
• What happens in the event of a security incident?
• Can data be deleted completely?
• What options does a company have if a provider's terms change?

These questions are relevant not only to personal data. They apply just as much to trade secrets, technical documents, customer strategies and internal expertise.

GDPR-compliant does not automatically mean secure

The term “GDPR-compliant” is often used like a general seal of quality. In practice, the claim has limited meaning without further explanation.

A company should examine more closely what the claim refers to:

• Does it refer to the location of the servers?
• To the contractual terms?
• To the deletion of data?
• To the use of inputs for training purposes?
• To access rights within the provider's organization?
• Or to the legal basis for processing?

A solution may be GDPR-compliant in one particular area and still involve risks elsewhere. That's why it's always worth looking at the system as a whole.

Server location alone is not enough

Many providers advertise that data is stored in Europe. This can be an important factor, but it does not answer every question.

It is also crucial to know which company operates the service, which laws that company is subject to, and who can access the data, technically or legally.

The US CLOUD Act is often mentioned in this context. Under certain conditions, this law can require US companies to hand over data to US authorities. This can also apply to data that is not stored in the United States.

Whether and to what extent this is relevant in a given case depends on the specific technical and legal setup.

For companies, this means that the storage location matters. Legal control over the data is at least as important.

What happens to data in large language models?

When using language models, people often enter content created in the course of their regular work. Employees ask them to improve texts, summarize documents, review contracts, draft proposals or answer technical questions.

Sensitive information can quickly find its way into external systems this way. Users are not always aware of exactly what data they are sharing.

The risk often does not arise from deliberate misconduct. It arises from convenience and a lack of rules.

Companies should therefore clearly specify what information may and may not be entered into external AI systems. Technical safeguards also play an important role.

In many cases, a centralized company solution with controlled access rights is safer than individual employees using personal accounts without oversight.

Provider dependency is also part of the risk assessment

Many powerful AI technologies today come from the United States. This offers companies great opportunities. At the same time, it creates a dependency on providers, platforms and political frameworks over which European companies have limited influence.

Services can change their prices. Features can be discontinued. Terms of use can be amended. Access to certain models can be restricted by region. Political decisions or export rules can also affect the availability of technologies.

Companies should therefore ask not only which solution is the most powerful today. They should also assess how reliably this technology will be available in the long term.

This becomes particularly critical when core processes depend entirely on a single provider. A technical decision can then quickly become a business risk.

Where companies need to go beyond the GDPR

Responsible use of AI requires more than a data protection review. It requires clear rules for company data, technical security measures, controlled access rights, careful provider selection and contracts that clearly set out what happens to the data.

It also requires a strategy for what to do if a service is no longer available, and employees who know what information they may enter into an AI system.

The GDPR remains important. But it is only one part of the bigger picture.

A Vimmera thought starter

Take a moment to ask yourself:

• Do you know what data your employees are already entering into AI systems?
• Are there clear rules for this?
• Do you know where this data is processed?
• Are you familiar with the legal frameworks governing the providers you use?
• Is it clear whether inputs are stored or used for training purposes?
• Could you switch providers if prices, terms or availability changed?
• Is confidential company data that does not fall under the GDPR also protected?

If you cannot give a clear answer to several of these questions, your company's use of AI should be examined more closely.

Question of the week

Would your company be adequately protected if all personal data were processed in full compliance with the GDPR starting tomorrow?

Or would risks to trade secrets, internal knowledge and strategically important information remain?

Key takeaways

The GDPR is important. It protects personal data and establishes clear rules for processing it. But when using AI, that alone is not enough.

Companies also need to pay attention to data security, confidentiality, technical control, legal access rights and dependence on individual providers.

Not all important information is personal data. But much of it is so valuable to a company that it needs to be protected just as carefully, if not more so.

A good AI strategy therefore does not start with the question of whether a solution is GDPR-compliant. It starts with the question of what data the company needs to protect and under what conditions that data may be processed.

Fancy taking a closer look?

Would you like to know what risks the use of AI poses to your company and how data protection, data security and technological independence can be effectively combined?

Feel free to write to us at info@vimmera.de. Together, we'll review your current use of AI and develop an approach that suits your requirements, your data and your company.