Your team already uses AI. The question is whether customer names, ID numbers, IBANs or health details are going into it, and whether you could justify that to a regulator. Work through these ten questions.
1. Is it personal data?
Names, emails, phone numbers, DNI or NIE numbers, IBANs and card numbers all are. So is anything that can identify a person when combined with other information. Health data is a special category under Article 9 of the GDPR and needs a stronger legal basis.
2. Do you have a legal basis?
Sending data to an AI service is processing. You need a basis under Article 6: for example, performing a contract with the customer, or a legitimate interest you have documented and balanced against their rights.
3. Is the AI provider your processor?
If the provider processes data on your behalf, you need a data processing agreement under Article 28 that limits what it may do with the data.
4. Does the provider train on your data?
Many consumer AI services may use what you send to improve their models. Business and API terms are often different. Check the exact terms of the service your staff actually use.
5. Where does the data go?
Transfers outside the European Economic Area need a mechanism such as an adequacy decision (including the EU–US Data Privacy Framework for certified US companies) or standard contractual clauses. Know which applies.
6. Can you send less?
Data minimisation (Article 5(1)(c)) is the strongest protection you have. Most tasks, such as summarising, classifying or drafting, work just as well when names and identifiers are replaced by tokens first. Pseudonymised data is still personal data if you can re-identify it, but the risk is far lower.
7. Do you need a DPIA?
A data protection impact assessment (Article 35) is required when processing is likely to result in a high risk, for example new technology applied to sensitive data or at large scale. Many AI uses meet that bar.
8. Have you told people?
Your privacy notice must say what you do with personal data, including if AI services process it.
9. How long is it kept?
Check how long the provider keeps prompts and outputs, and how long you keep logs yourself.
10. Do your staff know the rules?
Write a short policy: which AI tools are approved, what data may go into them, and what never may. Since February 2025, the EU AI Act also requires staff who use AI to have adequate AI literacy.
The practical answer
Banning AI rarely works; people use it anyway. A safer pattern is to route AI use through one controlled layer that removes personal data before any model sees it, keeps it in the EU, and logs what happened. You can try the redaction step in the demo on our home page: it runs entirely in your browser.