GDPR and AI automation: what to settle before you go live.
Automation moves personal data between tools, often to providers you have not used before. This checklist covers the questions to answer first. It is general information, not legal advice, so have your adviser confirm anything that matters.
6 min read. Updated
Start with a map of the data
Before anyone builds, write down one line for each step:
- What personal data it handles, such as names, emails or order details.
- Which tool or provider receives it.
- Where that provider stores and processes it.
- How long it stays there, including logs.
Check your providers
When a provider handles personal data for you, it normally acts as your processor. Article 28 of the GDPR requires a written agreement with it. Most established providers offer a standard data processing agreement, so ask for it and keep a copy.
If data leaves the EU or EEA, you need a valid basis for the transfer, such as an adequacy decision or standard contractual clauses. Ask each provider which one it relies on.
Be careful with AI providers
AI steps deserve their own questions:
- Is your data used to train the provider's models, and can you turn that off?
- How long does the provider keep what you send?
- Can you remove details the model does not need before sending?
Keep a person in serious decisions
Article 22 of the GDPR limits decisions based only on automated processing when they have legal or similarly significant effects on someone. Hiring, credit and contract termination are clear cases to treat with care.
The simple approach is to let the system prepare and a person decide. For higher-risk uses, ask your adviser whether a data protection impact assessment is needed.
Tell people, and keep it tidy
A few habits cover a lot of ground:
- Update your privacy notice if the new process changes what you do with data.
- Set retention periods for run logs and stored files.
- Keep access narrow, using company accounts and not personal ones.
- Check whether the EU AI Act adds duties, such as telling people when they deal with an AI system.
What to ask your builder
A good builder should give you the data map, the provider list and the settings used, in writing. On Aphelore, these belong in the handover documents, together with your accounts and exports.
Questions
Does self-hosting solve GDPR?
It helps with where data sits, but your duties remain. You still need a legal basis, retention rules, security and a way to answer requests from individuals.
Can we use AI on customer emails?
Often yes, with the right basis, provider terms and notice. What is appropriate depends on the content, so check with your adviser before you start.