AI and GDPR: what should SMEs know?

The basics

AI does not remove GDPR obligations. The same privacy principles apply, but AI can make data flows less visible.

• Know what personal data enters the tool.
• Check processor agreements.
• Avoid sensitive data unless necessary.
• Log important automated actions.

Make privacy part of the roadmap

Privacy should be designed into workflows before automation reaches production.

Map the personal-data flow before approving the tool

GDPR work begins with the actual processing, not a generic privacy statement. Document which personal data enters, for what purpose, through which model and suppliers, where outputs are stored and who can access them. Separate prompt data, source documents, logs, model development and generated output. That map allows the organisation to assess roles, legal basis, retention, transparency and security for each use rather than treating an AI product as one undifferentiated activity.

• Source, data category and affected people.
• Purpose and legal basis for each processing activity.
• Controller, processors and relevant subprocessors.
• Storage, access, transfers and deletion points.
• Supplier use of data for training or service improvement.

Turn purpose limitation and minimisation into controls

Do not collect everything in case it becomes useful. Send only the information required for the stated task and remove identifiers where possible. Separate development and production, using synthetic or properly anonymised examples when feasible. Limit logging, redact sensitive fields and enforce retention technically. Pseudonymisation reduces exposure but does not automatically take information outside data-protection law.

• Filter and redact input before the model call.
• Restrict context to the relevant customer, employee or case.
• Prevent open prompts from searching unrestricted databases.
• Delete temporary files and output under a defined schedule.

Review suppliers, contracts and international transfers

Identify every party processing the information, their subprocessors and whether inputs are used for model improvement by default. Contracts should cover instructions, security, deletion, incidents, audit support and assistance with individual rights. Establish where processing occurs and which safeguards apply to transfers outside the EEA. A business licence or famous vendor name is not a substitute for this assessment.

• Data processing agreement and documented instructions.
• Subprocessor register and change notification.
• Training, retention and supplier human-review settings.
• Export and verifiable deletion at contract termination.

Design meaningful oversight for decisions affecting people

Ranking applicants, assessing employees or influencing access to services carries greater risk than formatting internal text. Consider whether a data protection impact assessment is required and involve privacy, security and subject experts early. Reviewers need evidence and uncertainty, authority to disagree and enough time to think; a mandatory click is not meaningful human control. Processes must also support access, correction, objection and deletion where applicable.

• Assess possible harm, bias and incorrect identity matching.
• Test relevant groups and known edge cases.
• Record sources, model output and human intervention.
• Provide an accessible path to explanation and correction.

Keep privacy active throughout operation and change

A one-time review is not enough. Models, prompts, sources and suppliers change, and therefore the processing and risk may change too. Maintain an inventory of AI uses, owners, versions, evaluations and incidents. Test permissions and deletion regularly and reassess material changes before release. Connect this work to security monitoring and incident response. Obtain appropriate legal and privacy advice for sensitive data, uncertain legal bases or decisions with substantial effects.

• Periodic review of purpose, source data and necessity.
• Version history for models, prompts and evaluations.
• Response process for breaches, harmful output and access failures.
• Evidence of training, decisions and implemented safeguards.