GDPR and artificial intelligence: the business guide (with advice from 1215)

One of your staff pastes an angry customer's email into a chatbot, with name, order number and address, and asks: "help me reply". It looks harmless. In fact it's processing of personal data, with everything the GDPR requires. This guide explains, in practical terms, what a business using artificial intelligence must do to stay compliant: roles, legal bases, vendors, transfers, impact assessments, people's rights.

But first, as always, a history lesson. This time we go to Rome, in November 1215.

The secret of 1215 and "advice without a name"

In 1215 Pope Innocent III gathered at the Lateran one of the most important councils of the Middle Ages, the Fourth Lateran Council. Among its decrees is canon 21, known by its opening Latin words Omnis utriusque sexus: every believer, man or woman, having reached the age of discretion, must confess at least once a year to their own priest. It wasn't entirely new, as historians point out, but the canon made it a general rule across Latin Christendom.

Think about that for a moment as a data controller. Millions of people who, every year, hand a third party the most sensitive information of their lives. The largest archive of "special category data" in Europe, held in the memory of thousands of parish priests. How do you protect something like that?

The canon says it with a clarity many regulations would envy. The priest must take care not to betray the penitent "by word or sign or by any manner whatever". And whoever dares reveal a sin heard in confession is not only deposed from the priesthood but confined to a monastery to do perpetual penance (the text is quoted, among others, in the Catholic Encyclopedia entry on the seal of confession). So much for administrative fines.

But the sentence that interests me most is another, almost hidden. The canon allows that a priest facing a difficult case may need "wiser counsel". And then? Let him seek it, but cautiously and without any mention of the person.

You may ask: Professor, what does this have to do with AI? Everything. That priest seeking outside advice without naming names is exactly your employee in front of ChatGPT. Needing help is legitimate; how you ask makes all the difference. Eight hundred years later, the GDPR calls that gesture pseudonymization and data minimization. Your company today is in the same position: it holds other people's information and has a very powerful adviser at hand. Let's see how to use it without betraying anyone.

When the GDPR applies to AI

Regulation (EU) 2016/679 applies whenever personal data is processed, meaning information relating to an identified or identifiable person. The tool doesn't matter: spreadsheet, ERP or language model. For a business using AI there are three typical situations:

1. Using general-purpose assistants (ChatGPT, Claude, Gemini, Copilot): personal data ends up in prompts or uploaded documents.
2. AI inside business processes: an assistant answering customers, a system reading invoices, a tool screening CVs, a CRM scoring leads.
3. Training or customizing models with company data (for example a history of tickets or emails).

If nothing in the data leads back to a person, the GDPR doesn't apply. But careful: removing the name isn't always enough. An order number, an address or a very specific description ("our only customer in Bressanone who makes speck") can make someone identifiable.

Roles: who is controller and who is processor

When you use an AI tool on your company's behalf, the company is normally the controller (it decides why and how data is processed) and the vendor is a processor under Article 28 GDPR. This has a very practical consequence: you need a contract, the Data Processing Agreement (DPA), setting out what the vendor may do with the data.

That's the difference between personal and business plans. Business plans from the main vendors usually include a DPA and exclude, by default, the use of your content to train models. Free or personal consumer plans often don't. If an employee uses a private account with customer data, the company is in effect processing data with a party it has no contract with. That's the shadow AI problem, and the fix is a clear policy: see ChatGPT at work: rules for employees.

What to check in the vendor contract:

• whether your data is used to train models, and how to opt out;
• where it is stored and for how long;
• which sub-processors are involved (other cloud providers, for example);
• which security measures are guaranteed;
• how deletion requests and data breaches are handled.

Legal basis: why you may process that data

Every processing operation needs one of the Article 6 legal bases: contract, legal obligation, consent, legitimate interest and a few others. In practice:

• using AI to answer a customer's request often falls under performance of a contract or pre-contractual steps, because the data is used for the same purpose it was given for;
• using AI to analyze customer behavior for marketing usually requires legitimate interest (with a documented balancing test) or consent;
• reusing data collected for a different purpose (for example training a model on customer emails) needs careful assessment: the new purpose must be compatible with the original one.

The European Data Protection Board addressed legitimate interest in developing and deploying AI models in Opinion 28/2024 of December 2024: legitimate interest can be a valid basis, but only if the processing is truly necessary and the balance with people's rights holds, also considering what people can reasonably expect.

Special category data: twice the caution

Health, political opinions, religious beliefs, trade union membership, biometric data and the other data in Article 9 may be processed only in specific cases. If you're a medical practice, a pharmacy, a recruitment agency or an HR office, the practical rule is simple: this data does not go into a general-purpose assistant unless it's a tool assessed, contracted and configured for the purpose. When in doubt, the advice from 1215 still holds: ask for help "without any mention of the person".

Transparency: update your privacy notices

Articles 13 and 14 GDPR require you to tell people how their data is processed. If you introduce AI into a process that concerns them, the notice must be updated: which tools, for what purposes, with which vendors, whether there are transfers outside the EU.

Two more rules add to this:

• since August 2, 2026, Article 50 of the AI Act requires that people interacting with an AI system such as a chatbot be told they're dealing with a machine (unless it's obvious);
• in Italy, Law 132/2025 requires employers to inform workers about the use of AI (Article 11) and professionals to inform clients about the systems they use (Article 13). The same law, in Article 4, requires parental consent for children under fourteen to access AI technologies.

Minimization and privacy by design: advice without a name

The minimization principle (Article 5) says you process only the data you need. Article 25 asks you to design processes with data protection built in from the start. In everyday office life:

• remove names, tax IDs, addresses and phone numbers before pasting text into an assistant, if they're not needed for the task;
• replace data with placeholders ("Customer A", "Supplier B") and put them back yourself in the final answer;
• upload only the pages you need, not the whole file;
• turn off chat history or memory when you don't need it, if the tool allows;
• for recurring processes, consider tools that pseudonymize data automatically before sending it to the model.

Remember, though, that pseudonymized data is still personal data under the GDPR: whoever holds the "key" can trace it back. It reduces risk; it doesn't remove it.

Transfers outside the European Union

Many AI vendors are American. Transfers to third countries are governed by Chapter V of the GDPR (Articles 44 onward). For the United States there is currently a European Commission adequacy decision, the EU-U.S. Data Privacy Framework, adopted on July 10, 2023: transfers to US companies that have signed up are allowed without further tools. The EU General Court dismissed a challenge to that decision on September 3, 2025 (Case T-553/23, Latombe); an appeal has been lodged with the Court of Justice, so keep an eye on it.

In practice: check in the contract where data is processed, whether the vendor is certified under the Data Privacy Framework or uses standard contractual clauses, and whether it offers EU data residency. Several vendors offer it on business plans.

Automated decisions: Article 22

Article 22 GDPR gives people the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them. Think of a system that automatically rejects candidates, refuses credit or blocks a customer without a person looking at the case.

Exceptions exist (contract, law, explicit consent), but they require safeguards: at least the right to obtain human intervention, to express one's view and to contest the decision. The practical rule for a small business: AI proposes, a person decides. And the human review must be real, not an automatic click on "approve".

For AI in recruitment, the AI Act adds another layer, classing these systems as "high-risk": after the postponement in Regulation (EU) 2026/1744, the related obligations apply from December 2, 2027.

Data protection impact assessments (DPIAs): when you need one

Article 35 GDPR requires a DPIA when processing, especially using new technologies, is likely to result in a high risk to people's rights. AI doesn't automatically make a DPIA mandatory, but it makes one much more likely if you:

• process special category data (health, for example) at scale;
• evaluate or score people (customers, candidates, employees);
• systematically monitor workers' behavior;
• combine data from different sources in ways people wouldn't expect.

For users of high-risk AI systems, Article 26 of the AI Act says deployers shall use the information supplied by the provider to carry out their DPIA. The two laws work together.

A DPIA isn't a novel: it describes the processing, assesses necessity and proportionality, identifies risks and the measures to reduce them. Done at the start, it saves you from discovering problems once the system is live.

Security and data breaches

Article 32 requires security measures appropriate to the risk. With AI that means: business accounts with two-factor authentication, role-based permissions, no access keys shared by email, and care with tools connected to email or archives (which can be manipulated by instructions hidden in documents, so-called prompt injection). If a breach occurs, Article 33 requires notifying the supervisory authority within 72 hours when it poses a risk to people. We have a separate guide on AI-related security risks: phishing and cybersecurity for small businesses.

What the Italian regulator teaches us

Italy's data protection authority, the Garante, has been one of the most active in Europe on generative AI. Three cases worth knowing:

• ChatGPT, March 2023. The Garante ordered a temporary limitation of processing of Italian users' data, citing among other things missing information, no legal basis for training and no age verification. The service came back after OpenAI adopted a series of measures.
• OpenAI, December 2024. Closing its investigation, the Garante announced a €15 million fine and a six-month information campaign. OpenAI appealed, and in March 2026 the Court of Rome annulled the decision, upholding the objections on the Italian authority's competence, since OpenAI had in the meantime set up its main EU establishment in Ireland.
• DeepSeek, January 2025. The Garante ordered an urgent limitation of processing of Italian users' data after the companies gave answers it deemed insufficient, claiming they were not subject to European law.

The lesson for a business isn't "avoid this or that vendor". It's simpler: choose tools for which you can document where the data goes and under which contract. If you can't answer those two questions, the problem isn't the vendor's: it's yours.

The GDPR checklist for AI at work

Typical scenario: an online store with a customer assistant

Picture an online homeware store, 12 people, thousands of support requests a month. The company wants an AI assistant to answer questions about order status and returns.

The right steps: choose a vendor with a DPA and EU data residency; connect the assistant only to the data it needs (order status, not the full purchase history); tell customers clearly they're talking to an automated assistant and how to reach a person; update the privacy notice; keep decisions that affect the customer, such as refusing a refund, with a person; set retention periods for conversations. It's a typical scenario, but it covers 90% of the cases we see.

Frequently asked questions

Can I use ChatGPT with customer data without breaching the GDPR?

Yes, if you use a business plan with a data processing agreement, have a legal basis for that purpose, have informed people and enter only the data you need. With a free personal account and identifiable customer data the risk is high: better avoid it.

Do I need customer consent to use AI?

Not always. If AI is used to handle the customer's request, the basis is often the contract. Consent becomes necessary in specific cases, for example some marketing uses or processing special category data when no other basis applies. It must be assessed case by case.

When is a DPIA mandatory for an AI system?

When the processing is likely to pose a high risk: typically if you evaluate or profile people, process health data at scale or monitor employees. When in doubt, a short DPIA is still a useful way to document your choices.

What does the AI Act change compared to the GDPR?

The GDPR protects personal data; the AI Act regulates AI systems by risk level. They apply together: the AI Act doesn't replace the GDPR. For a small business using AI, today the AI Act mainly requires transparency toward people talking to a chatbot and AI literacy measures for staff; obligations for high-risk systems, such as recruitment tools, apply from December 2, 2027.

Further reading and support

This guide is part of our series on AI at work: start with the complete guide to AI for small businesses, read how to set up employee training and what the AI Act means for SMEs. If you work in a professional firm, our page for professional firms covers the most common cases.

At Penzai we design AI solutions with data protection built in from the start, together with your DPO or privacy adviser. See our services or book a free intro call: we start from the tools you already use.

This guide is for information only and is not a substitute for legal advice on your specific case.