AI and GDPR: Personal Data in Artificial Intelligence Tools

AI and GDPR intersect every time personal data enters an artificial intelligence (AI) tool - whether it’s ChatGPT, a translation program, or an AI function in an accounting system - because from that moment, the General Data Protection Regulation (GDPR) applies to the company. This means that using AI is not a legal “grey area”: the same rules that apply to employee or client data in an Excel spreadsheet also apply when you input that data into an AI chat. For a micro-enterprise, the most important thing to understand is that pasted text containing a person’s name, email, contract terms, or health information constitutes processing of personal data, for which you are responsible.

Many small Lithuanian businesses started using AI spontaneously: some learned to write emails faster with ChatGPT, others input client lists for AI analysis. The problem is that personal data quietly “leaks” to third-country servers without any legal basis or employee awareness of the risks. Safe AI usage begins with a simple question: what data is the employee actually entering into the tool?

Does GDPR Apply to AI Usage?

Yes - GDPR applies to AI usage whenever AI tools process personal data, i.e., any information relating to an identifiable natural person. AI itself does not change anything legally: if you enter a client’s name, phone number, life story, or an employee’s performance evaluation, this is data processing that requires a legal basis, purpose, and appropriate safeguards.

It is important to distinguish between two cases:

• AI usage with personal data - for example, pasting client reviews with names, asking AI to write a response to a specific person, or inputting CVs for candidate screening. GDPR applies in full.
• AI usage without personal data - for example, asking AI to generate a general marketing text, explain a concept, or write code. There is no personal data, so GDPR risk is minimal.

The practical difference is significant. A micro-enterprise can obtain most of the benefits of AI in the second way - without entering any personal data. For more on how to make daily ChatGPT usage safe, read our article Using ChatGPT in a Company.

How Does GDPR Differ from the EU AI Act?

Micro-enterprises often confuse these two separate regulations. They operate simultaneously but address different issues.

The key point is that when you use AI with personal data, both legal acts apply simultaneously. The EU AI Act requires that companies (regardless of size) take measures to support the development of AI literacy among staff and other persons using AI on their behalf (Article 4 entered into force on 2025-02-02, with supervision and enforcement from 2026-08-02). GDPR requires that personal data be processed lawfully. General-purpose AI model rules began applying on 2025-08-02, subject to transitional provisions; Article 50 transparency provisions applied from 2026-08-02. AI literacy training, as suggested by the EU AI Act, helps implement the rule “do not enter personal data into unverified tools.”

What Are the Main GDPR Risks When Using AI Tools?

When using AI tools with personal data, several specific risks arise that are worth knowing in advance:

1. Data transfer outside the EU. Many popular AI tools process data in the US or other countries. Without an appropriate legal mechanism (e.g., Standard Contractual Clauses or an adequacy decision), this may constitute an unlawful data transfer.
2. Use of data for model training. In free or standard versions, entered data may be used to train the AI model. This means your client data could “leak” beyond your control.
3. Lack of legal basis. You enter employee or client data without consent or another GDPR legal basis (e.g., contract performance, legitimate interest).
4. Lack of transparency. Data subjects (clients, employees) are unaware that their data is being processed by AI tools, even though GDPR requires them to be informed.
5. Accuracy and automated decision-making risks. AI can “hallucinate” facts about a person. If decisions about individuals (e.g., rejecting a candidate) are based solely on such outputs, this may violate GDPR (Article 22).
6. Security vulnerabilities. Entering data via personal, unsecured employee accounts increases the risk of leaks.

The biggest practical problem in micro-enterprises is “shadow AI” - employees use tools on their own initiative, and management does not even know what personal data and where it is being sent. This is why the first step should be an inventory and clear rules.

How Can a Micro-Enterprise Use AI Safely Without Violating GDPR?

Safe AI usage in a micro-enterprise requires a few clear, everyday rules. Here is a practical list:

• Always ask first: does this text contain personal data? If yes - stop and consider whether it is truly necessary to enter it.
• Anonymise the data. Before entering text, replace real names, emails, and other identifying data with generic terms (“Client A”, “Employee X”). Often, AI performs the task just as well.
• Use business (not free) versions of AI tools. Business plans for ChatGPT Team/Enterprise or Microsoft Copilot usually commit to not using your data for model training. Check the provider’s terms.
• Conclude a Data Processing Agreement (DPA). When an AI provider processes personal data on your behalf, it is a data processor, so under GDPR Article 28, a contract is required. Many major providers offer this as standard.
• Enable data control settings. In most tools, you can disable chat history or use for training.
• Restrict special category data. Do not enter health, religious, political, ethnic, sexual-orientation or relevant biometric data into unapproved tools. Any proposed processing needs an appropriate Article 9 condition as well as the other GDPR requirements and safeguards.

These rules should not remain only in the manager’s mind - they need to be written down. For this purpose, there is the AI Usage Policy in a Company, and practical daily guidelines for employees are provided in the Employee AI Guide.

When Does an AI Provider Become a Data Processor?

An AI provider becomes a data processor when it processes personal data on your behalf (as the data controller) and under your instructions. Practically, this happens when you process client or employee data through the tool. In such cases, GDPR requires:

1. Conclude a Data Processing Agreement (DPA) with the provider.
2. Verify where the data is physically processed and whether there is an appropriate mechanism for transfers outside the EU.
3. Include this provider in your records of processing activities.

How to Document the Intersection of GDPR and AI?

Recording the selected data protection measures helps explain how AI is used responsibly. In a typical micro-enterprise AI compliance package, the GDPR aspect is reflected in several places:

• AI Tools Register - for each tool, note whether it processes personal data and what kind. This is the first signal of where GDPR risks arise.
• AI Usage Policy - rules regarding personal data: what can and cannot be entered.
• Employee AI Guide - practical examples of how to anonymise data.
• AI Literacy Training - employees are trained to recognise personal data and understand the risks.

AI usage in accounting is particularly sensitive because it involves processing financial and personal data simultaneously - read more in the article AI Tools in Accounting. All related AI compliance articles can be found in the list of all articles.

If you do not want to manually prepare all these documents, nebedirbam.lt automatically generates an AI Usage Policy, AI Tools Register, compliance record, and Employee AI Guide with AI literacy training for a fixed €149 + VAT (€299) price without any human intervention. Learn more on the homepage. For those who first want to learn, there are also free AI Literacy Training courses with knowledge checks and certification. These documents and training are practical guidelines but do not guarantee legal compliance with the EU AI Act or GDPR - requirements depend on the specific situation and legal assessment. The free path is for one signed-in participant; team training is included in the paid documentation package.

Common Mistakes in Combining AI and GDPR

Observing how micro-enterprises start using AI, several recurring mistakes stand out:

• “AI is not a data protection issue.” It is assumed that if there is no database, there is no GDPR risk. In reality, even a single pasted client list constitutes data processing.
• Using free versions for work. Personal free accounts usually lack a DPA and may use data for model training.
• Trusting AI responses about people. AI can “hallucinate” facts, so decisions about individuals should never rely solely on AI.
• Not informing employees. Without clear rules, employees enter whatever is convenient, unaware of the risks.
• Mixing personal and work AI. The same tool processes both private and company data in one place.

By avoiding these mistakes, AI becomes a safe productivity tool rather than a hidden GDPR risk. For more on the safe use of specific tools, read the article Using ChatGPT in a Company.

Brief Summary

AI and GDPR intersect whenever personal data enters an AI tool - from that moment, the General Data Protection Regulation applies, regardless of whether the data is in a spreadsheet or an AI chat. For a micro-enterprise, the most important steps are: before entering anything, ask if it contains personal data; anonymise where possible; use business versions with a Data Processing Agreement; and restrict special category data to specifically assessed and approved processing. The EU AI Act (Regulation (EU) 2024/1689) and GDPR ((EU) 2016/679) apply simultaneously, so safe AI usage means complying with both at the same time. Write down the rules in a policy and employee guide, and you will manage the risk from the very first step - inventorying which tools process personal data.

For the current text of EU AI Act Article 4 and its application dates, see the EU AI Act Helpdesk and the European Commission’s Digital Strategy page. These sources provide official information about the EU AI Act; GDPR obligations also require a separate assessment. For the GDPR aspects, consult European Commission guidance on legal bases and special category data.