Data protection and AI: GDPR-compliant AI in practice

Rolling out AI systems and complying with the GDPR are not opposing goals, as many assume. They are two areas that have to be planned together from the start. In practice, most problems do not come from a business knowingly breaking data protection rules.

Where the problems really come from

They come from not thinking through, when the AI system is introduced, what data goes to the model, where it is stored and who can access it. Data protection and AI in practice is no more complicated than making any other data-handling system compliant. It just needs deliberate planning.

Why the GDPR risk of AI systems differs from traditional software

With traditional software, the path of the data is usually easy to follow: it goes into a database, stays there and is used for a defined purpose. With AI systems, especially solutions that use large language models, the process is more complex.

The data often goes through an external API to a third party's infrastructure, is processed there and, in some cases with incorrectly configured systems, can even be used for further training of the model.

So the key GDPR questions are where the data goes, how long it is stored, and whether a contract guarantees it will not be used for any other purpose.

The most common GDPR pitfalls when introducing AI

• Giving the model too much data: many businesses hand the whole customer database to an AI tool to be on the safe side, when the task needs only a few fields.
• No clear data processing agreement: if you use an external AI provider, you must sign a data processing agreement (DPA) with them, but this is often skipped.

Decisions and deletion

• Automated decisions without human oversight: if the AI independently makes a decision that significantly affects the person concerned, such as a credit assessment or rejecting a job application, separate legal requirements apply.
• No data deletion mechanism: if a data subject validly asks for erasure, the business must also handle the data in the AI system, its logs and its caches, taking account of the statutory exceptions to erasure.

Data minimisation and purpose limitation in AI systems in practice

One of the basic principles of the GDPR is that you may process only as much data as is strictly necessary for the specific purpose.

For AI systems this means asking at the design stage: does an AI agent really need the full customer history to answer a delivery question, or are the order number and delivery status enough?

What data not to give an AI model needlessly

As a practical rule, avoid putting these types of data into an AI system without need: health data, bank account numbers, the numbers of personal identity documents, or any special category data, such as political opinion or religious belief, unless the specific task clearly justifies it.

If an anonymised or pseudonymised dataset is enough for a process, use that instead of the full, identifiable data.

Where data is stored: inside or outside the EU

Many businesses do not know where the servers of the AI service they use are physically located. This matters because transferring data outside the European Union, for example to US cloud providers, needs a legal basis: either you use a provider certified under the EU-US Data Privacy Framework (based on a European Commission adequacy decision), or you must rely on standard contractual clauses and further safeguards. In practice, it is worth doing the following:

• Ask every AI provider where they store and process the data.
• Prefer providers that offer a data centre inside the EU, especially for sensitive data.
• Get it in writing from the provider that the data will not be used for their own model development without the customer's permission.

Regulated industries

In regulated industries such as finance or healthcare, this point alone often decides between on-premise or EU-based cloud AI infrastructure, instead of foreign data handling that is hard to verify.

Human oversight and the rule on automated decision-making

The GDPR has a separate rule for decisions based solely on automated processing that have a legal or similarly significant effect on the person, such as an automatic credit assessment or job rejection. According to the EU Court of Justice, even producing a credit score can count as an automated decision if the lender relies heavily on it.

In these cases the person has the right to ask for human intervention, to express their point of view and to contest the decision.

The practical solution is to build a human approval point into every AI decision that could significantly affect a person, before the decision becomes final. For automated decisions this is often also a legal requirement under Article 22 GDPR (the person must be able to obtain human intervention), and it also protects against the reputational risk of wrong, fully automated decisions.

A practical checklist for GDPR-compliant AI rollout

1. Make a data inventory: exactly what data goes into the AI system, and where it comes from.
2. Sign a data processing agreement with every external AI provider.
3. Minimise the data: pass only the fields strictly needed for the task to the model.
4. Check where the data is stored, and prefer an EU-based option for sensitive data.
5. Build in a human oversight point for every automated decision with a significant effect on the person concerned.
6. Set up a data deletion process that also covers the AI system's logs and caches.
7. Review regularly: review the AI system and its related data handling every year or after any significant change.

Summary

GDPR-compliant AI in practice does not mean a business gives up the benefits of AI. It means planning deliberately what data goes into the system, where it is stored and where human oversight is needed.

Data minimisation, contractual safeguards and following the rules on automated decision-making do not slow the rollout down in any meaningful way, but they cut the legal and reputational risk significantly.