Safety and compliance
GDPR and AI: the basics for small businesses
What the GDPR means when you use AI tools with personal data: purpose, processor, transparency and data minimisation. In plain language.
6 min read
The GDPR, the EU data protection regulation, applies when you use AI tools too. As soon as you put personal data about customers, employees or others into an AI tool, you're processing that data. That needn't be a problem if you follow a few basic rules.
Five basic questions
1. Why are you using the data? You need a clear reason that fits the purpose you collected the data for. Answering a customer's email with AI help fits customer contact. Using customer data for something quite different, not necessarily.
2. Do you really need it? Use as little personal data as possible. Often it's enough to leave names out.
3. Who else processes the data? The AI provider processes data on your behalf. Business plans should come with a data processing agreement covering security, retention and where data is processed. Personal accounts are governed by consumer terms.
4. Do the people concerned know? If you process personal data with AI tools, mention it in your privacy notice, along with the purpose.
5. Is it secure? Manage access, use strong passwords and two-factor authentication, and close accounts when someone leaves.
Sensitive data
Health, ethnic origin, religion, trade union membership and other special categories of data need extra care. Don't put them into an AI tool without an approved environment and a clear legal basis.
What you can do today
- Choose a business AI plan for work involving personal data.
- Set out in your AI policy what is and isn't allowed.
- Update your privacy notice if necessary.
- Teach your staff to anonymise.
Checklist
Your answers stay only in this browser.
Prompt to copy
We want to use AI tools for [tasks] and in doing so we process [types of personal data]. List the questions I need to answer under the basic GDPR principles: purpose, data minimisation, processor, transparency and security. Don't give legal advice, and flag what I need to agree with a data protection specialist.
