AI and GDPR: What a company needs to know before using AI

Whenever a company uses AI to respond to customer emails, analyze documents, automate CRM, or profile users, it is almost certainly processing personal data. And where there is personal data, the GDPR — with no exceptions related to the technology used. applies.

The problem is not the AI itself. The problem is that many SMEs adopt AI tools without asking themselves: on what basis are we processing this data? Do we have a contract with the provider? Is the information updated? These are questions that the GDPR explicitly asks — and ignoring them exposes you to concrete risks.

This article is not legal advice. It is a practical guideline on the main obligations that the GDPR imposes when using AI in the company, with specific articles to refer to. For the evaluation of your specific case, always consult a qualified lawyer or DPO.

If you also want to learn more about how to manage business data in daily AI tools, read AI and corporate privacy. For technical safety aspects, AI and Data Security.

When the GDPR applies to the use of AI in the company

The GDPR applies whenever we process personal data of natural persons in the EU — regardless of who or what carries out the processing. AI is not an exception: if an AI tool processes names, emails, behavioral data, geographical locations or any other information that identifies or makes a person identifiable, you are within the scope of the GDPR.

In business practice, almost every AI application involves personal data:

• Use AI to respond to customer emails: messages contain names, requests, purchase data.
• Analyzing documents with AI: Contracts, invoices, and communications often include personal data of employees or suppliers.
• Integrating AI into CRM: Contact data and business interactions are personal data by definition.
• Automate customer care: conversations with customers almost always contain identifying information.

Internal use is also not neutral: using an AI model to analyze employee performance, summarizing meetings, or managing HR communications treats personal data of workers, with additional specific obligations.

The relevant threshold is not "we are using AI", but "we are processing personal data with AI" — and the answer, in the vast majority of business cases, is yes. For a broader introduction to AI in the company, see AI for businesses: a complete guide to getting started.

The legal basis: on what basis the data is processed with AI (Art. 6 GDPR)

Article 6 of the GDPR states that any processing of personal data must be based on a legal basis. You can not process data "because it is useful" or "because AI does": you need a specific foundation among those listed in the Regulation.

The most relevant legal bases for the use of AI in the company are three:

Consent (Art. 6.1.a): the data subject has given a free, specific, informed and unambiguous consent. Consent works well when it comes to marketing or advanced customer profiling. It is not suitable for treatments necessary to provide a service — if consent is a condition for obtaining the service, it is not free.

Performance of a contract (Art. 6.1.b): processing is necessary for the performance of a contract with the data subject or to take pre-contractual measures at the data subject's request. If you use AI to handle orders, invoices, or contractual communications with customers, this base often holds well.

Legitimate interest (Art. 6.1.f): processing is necessary for the pursuit of a legitimate interest of the controller or third parties, provided that the interests or fundamental rights of the data subject do not prevail. It is a flexible basis — but requires an assessment (the so-called balancing test) that documents why the holder's interest prevails. It should not be used as a generic loophole.

How to choose the right legal basis: There is no valid answer for all treatments. The same AI tool can have different bases for different uses: analyzing customers' emails to respond to requests (contract execution) is different from analyzing them to build behavioral profiles (legitimate interest, with balancing test, or consent). Consult a legal expert to map each treatment to the correct legal basis.

The DPA with AI providers: what it is and when it is needed (Art. 28 GDPR)

When relying on an external provider the processing of personal data, the GDPR (Art. 28) requires the conclusion of a Data Processing Agreement (DPA). in Italian, Agreement on the Processing of Data. The DPA is not an option: it is a mandatory contract that defines what the provider can do with the data, for how long, with what security measures and in which countries.

Every AI provider that accesses personal data is a data processor and requires a DPA. This includes platforms such as OpenAI (ChatGPT Enterprise, API), Microsoft Copilot and Google Gemini for Workspace, as well as specialist tools that use third-party AI models.

What to check in the DPA:

• Can the provider use your data to train their models? (If so: is it acceptable? Does it require opt-out?)
• Are data transferred outside the EU? If so, on what basis (standard contractual clauses SCC, adequacy decision)?
• What security measures are guaranteed?
• Does the provider notify breaches within the terms of the GDPR?

Without signed DPA, using AI tools on personal data of customers or employees constitutes a GDPR violation regardless of the technical quality of the tool. To understand how to manage data in daily AI sessions, AI and corporate privacy It covers operational behaviors.

The privacy policy: should it be updated when using AI? (Art. 13-14 GDPR)

Yeah. Article 13 of the GDPR requires that data subjects be informed at the time of data collection about how they will be processed — including the tools and categories of recipients. Art. 14 extends the obligation to data collected indirectly.

If you introduce AI into the data processing stream, the disclosure must reflect this change. In particular:

What to update in the information:

• The purposes of the processing: if you use AI to analyze customer requests, optimize communications or profile behaviors, it should be indicated.
• The categories of recipients: AI providers are recipients of the data and should be indicated (also in generic category form, with the possibility of providing details on request).
• Non-EU transfers: If the AI provider has servers or sub-processors outside the EU, the guarantee mechanism (SCC, adequacy decision) should be indicated.
• The logic of automated processes: If you are using AI systems that profile or make automated decisions, you should describe the operation in principle.

When to update: before activating the new AI stream, not after. The information must be accurate at the time of treatment, not a posteriori.

A frequent mistake in SMEs is to consider information to be a static document to be written once. It actually needs to be kept up to date whenever the purposes, tools or recipients change — and the introduction of AI usually involves all three. For an overview on AI for SMEs, including the practical aspects of adoption, is a good place to start.

The rights of data subjects and the AI (Art. 15-22 GDPR)

The GDPR gives data subjects unacustomers, employees, suppliers, visitors.a number of rights that do not fail when data is processed with AI. In fact, in some cases AI makes them more relevant.

Right of access (Art. 15): the data subject can ask which personal data are processed, for what purpose, for how long, to whom they are communicated. If you use AI to analyze customer data, you must be able to respond to this request comprehensively.

Right of rectification (Art. 16): the incorrect data must be corrected. If the AI has processed incorrect data and produced output based on it (e.g. a wrong classification of a customer), the rectification of the basic data does not automatically solve the problem of the outputs already produced.

Right to erasure (Art. 17): the data subject can request the deletion of their data in certain cases. If the data has been used to train an internal model or to power a profiling system, technical deletion can be complex. It is worth checking with the AI provider how they handle cancellation requests.

Right to portability (Art. 20): The data subject may request their data in a structured and readable format. This right applies to data actively provided by the data subject, processed on the basis of consent or contract.

Right to object (Art. 21): The data subject may object to processing based on legitimate interest, including profiling. If AI is used to build behavioral profiles on the basis of legitimate interest, a concrete mechanism to exercise this right must be guaranteed.

The management of these rights requires operational processes — it is not enough to know them: an internal flow is needed to receive, verify and respond to requests within the scheduled deadlines (usually one month, which can be extended by another two months in complex cases).

Automated decisions (Art. 22 GDPR): when the obligation arises

Art. 22 of the GDPR is probably the most specific rule on AI, even if it does not explicitly mention it. It prohibits l with exceptions — that the data subject is subject to decisions based on solely on automated processing that produces legal effects or significantly affects him.

When Art. 22:

• Fully automated credit scoring systems
• Automated selection of candidates (HR) without human review
• Automatic profiling leading to denial of a service
• Custom dynamic pricing with significant effects on the contract

What does not fall under Art. 22:

• Decisions that have significant (not just formal) human intervention
• AI recommendations that a human operator assesses before acting
• Aggregate analyses without legal effects on the individual person

The three exceptions to Art. 22 (when the automated decision is allowed):

1. It is necessary for the performance of a contract
2. It is authorized by law
3. It is based on the explicit consent of the data subject

In all three cases, however, the information to the data subject about the existence of the automated decision, the right to obtain the intervention of a natural person, the right to challenge the decision must be guaranteed.

For SMEs, Art. 22 is rarely taken in pure form — but it is worth checking whether you use scoring systems, automatic segmentation or AI filters with direct effects on customers or employees. If you also use AI in corporate customer care, verify that automated responses do not constitute unilateral decisions on requests or complaints.

Impact Assessment (DPIA): when it is mandatory (Art. 35 GDPR)

Article 35 of the GDPR requires you to conduct a Data Protection Impact Assessment (DPIA) una a preventive assessment of privacy risks — before initiating high-risk treatments.

The use of AI may fall under the DPIA requirement in the following cases:

• Large-scale systematic profiling: AI systems that build behavioral profiles of customers or users extensively.
• Processing of special categories of data (Art. 9): data on health, ethnic origin, political opinions, sex life — even if treated as input from an AI system.
• Systematic monitoring: AI systems that track the behavior of employees, visitors or users continuously.
• Automated Decisions with Significant Effects (in conjunction with Art. 22).

The Italian Privacy Guarantor has published guidelines on cases where the DPIA is mandatory. For high-risk treatments, the DPIA is not optional: it must be conducted before the start of the treatment, documented and). if the residual risk remains high). the Guarantor must be consulted in advance (Art. 36).

• Have I identified what personal data is being processed by the AI tool I am using?
• Have I defined the legal basis for each processing purpose (Art. 6)?
• Have I signed a DPA with each AI provider that accesses personal data (Art. 28)?
• Does the DPA include clauses on non-EU transfers (SCC or adequacy decision)?
• I checked if the AI provider uses the data to train their models and, if so, how to disable it?
• Have I updated the privacy policy to include new purposes, AI providers and any transfers (Art. 13-14)?
• Do I have an operational process to handle requests for access, rectification, cancellation and opposition (Art. 15-22)?
• Have I checked whether AI systems produce automated decisions with significant effects on the person (Art. 22)?
• Have I evaluated whether DPIA is necessary before starting treatment (Art. 35)?
• Have I documented the treatment log (Art. 30) including the new AI streams?

Practical examples: two SME scenarios

Scenario 1: Professional studio using AI on client documents

A firm of accountants adopts an AI assistant to analyze contracts and tax documents, extract relevant data and draft drafts. The documents contain personal data and sometimes tax data of natural persons.

Obligations that are taken:

• Legal basis: probably execution of the professional contract with the customer, possibly legitimate interest in some internal analysis.
• DPA: mandatory with the AI provider (e.g. OpenAI, Microsoft). It should be verified that the provider does not use the documents to train models.
• Information: it should be updated to indicate that the documents provided can be processed with AI tools and which are the suppliers.
• Employees and sensitive data: if the documents include health data or sensitive tax data (Art. 9), the DPIA should be evaluated.

To deepen the use of AI in document analysis, AI to analyze business documents provides a practical framework. For the specific sector, AI for law firms and AI for accountants deal with vertical use cases.

Scenario 2: E-commerce with user AI profiling

An e-commerce uses an AI system to automatically segment customers based on buying behavior and send personalized offers. The system assigns "propensity to purchase" scores and independently decides who receives which offer.

Obligations that are taken:

• Legal basis: profiling for marketing purposes requires specific consent, one cannot rely on only legitimate interest without a solid and documented balancing test.
• Automated decisions (Art. 22): if the system decides who receives an exclusive offer and who does not, with potential significant economic effects, the applicability of Art. 22 must be verified. The possibility of contesting the decision must be guaranteed.
• Informative: must clearly describe profiling, system logic and effects on the person.
• DPIA: Systematic large-scale profiling often falls under cases where DPIA is recommended or mandatory.

Memory of an assistant and data deletion

A persistent assistant adds an operational question: what is remembered and how to eliminate it? The guide to Memory, Privacy, and Data in Dots distinguishes memory resets, app disconnects, files, and threads. A single operation should not be presented as a complete deletion of all copies.

Mistakes to Avoid

"We have DPA but we haven't read it": signing the DPA is necessary but not sufficient. Read and understand it, and check that the clauses on transfers outside the EU, model training and security are acceptable.

"We use ChatGPT but only internally": The consumer version of ChatGPT (no Teams or Enterprise subscription) does not include a DPA. Entering personal data of customers or employees in the free version is problematic from the GDPR point of view, regardless of the "internal only" use.

"Legal basis is legitimate interest": Legitimate interest is not a residual legal basis to use when you don't know which one to choose. It requires a documented assessment. Using it without documented balancing test is a frequent mistake.

"The information is on the site, okay": the information must reflect current treatments. If you introduce a new AI tool that changes the purposes or recipients, it must be updated before activating it, not after.

"AI provider thinks about it": the AI provider is the data processor, not the data controller. Responsibility for compliance remains with the company using the tool. The DPA defines the provider’s responsibility, but does not replace the data controller’s responsibility with it.

How to apply it in the company

A practical approach for SMEs starts with a census: what AI tools are in use, what personal data they process, what legal basis and whether there is a DPA in place. You don't need to start from the norm — you need to start from the real flows.

Concrete steps:

1. Map AI treatments: list of AI tools in use and personal data they touch.
2. Verify DPA: check for each supplier if the DPA exists, is signed and includes the necessary clauses.
3. Update the processing log (Art. 30): include new AI flows with legal basis, recipients and security measures.
4. Update the information: integrate new purposes, AI providers and transfers.
5. Training the team: Those who use AI tools need to know what data they can and can't enter.
6. Assessing DPIA: for high-risk treatments, before starting the flow.

If you're building a broader AI strategy, AI consulting for companies describes how to structure an adoption path that includes compliance from the start. For practical tools such as managing Business knowledge base with AI or the AI agents, it is worth figuring out where they are located in the GDPR perimeter of your organization.

Conclusion

The GDPR does not prevent the use of AI in the company. It requires doing so with awareness: knowing on what basis the data is processed, having the right contracts with suppliers, keeping the information up to date and ensuring the rights of the data subjects.

For SMEs, the starting point is not the norm — it is the census of real flows. What AI tools do we use? What data do they touch? Do we have DPA? From there, compliance is built in a progressive and sustainable way.

If you want to understand how to structure the adoption of AI in your company starting already with the correct GDPR perimeter, Contact Us or discover our AI Consulting Services.

Related insights:

• AI and corporate privacy: how to manage data in AI tools quotidiani daily operating behaviors for teams and managers
• AI and data security: technical and organizational measures tecnica the technical dimension of data protection
• How to Avoid AI Hallucinations output reliability of AI outputs in business context