AI and data protection: what businesses must consider.
AI only helps if your team is allowed to use it with real data. This guide shows where AI and data protection collide, what the GDPR requires and how you answer the questions of data protection and the works council, whether your AI runs in the RAGSuite Engine or on your own server.
Not legal advice · as of 13 October 2026
- Where does the data go?data centre in Germany or your servers
- Is there a new processor?cloud: DPA with us · self-hosted: no
- How long is it kept?deletion period with receipt
- Where’s the documentation?TOMs & record template
- Are employees analysed?no telemetry
- Can storage be switched off?yes, for chat and search
- Do users know it’s AI?AI notice in the widget
- Who sees what?roles and teams
- How do users sign in?2FA, session timeout
- Who changed what?audit log
- Does it phone home?no phone-home
- How is it updated?via the CLI, data kept
Key takeaways
- AI data protection means settling purpose, legal basis and data flow before personal data goes into an AI.
- The most common problems: another provider, transfers to third countries, answers without origin and performance monitoring.
- No software is automatically compliant; responsibility stays with the company.
- RAGSuite runs in the RAGSuite Engine (with a DPA) or on your server (no new processor).
What does data protection mean for AI?
Data protection for AI means: as soon as an AI processes personal data, in questions, documents or history, the GDPR applies as for any other software. You need a clear purpose, a legal basis, contracts with every provider and rules for storage and access.
What is new with AI is mainly the data flow: where do questions and documents go, who can access them, and are they used to train a model? If you answer these three questions clearly, you have done most of the work.
AI data protection problems, and how to avoid them.
Data goes to another provider
Every AI service is a processor your data protection team must assess and contract. With RAGSuite: in the RAGSuite Engine you sign a DPA with us; self-hosted, the platform adds no new processor.
Transfers to third countries
If the provider is outside the EU, you need standard contractual clauses and a transfer impact assessment. With RAGSuite: platform and data in Germany; for the model you choose EU providers or, self-hosted, a local model.
Answers without origin
If you cannot see where an answer comes from, you cannot check it, or prove it later. With RAGSuite: every answer names its source, and the audit log records what changed in the system.
Performance monitoring
If a system can analyse behaviour or performance, the works council has a say. With RAGSuite: no telemetry, storage can be switched off, deletion periods with receipts.
What RAGSuite contributes, and what stays with you.
| GDPR | What RAGSuite contributes | What stays with you |
|---|---|---|
| Art. 5: minimisation, storage limitation | storage can be switched off, automatic deletion period with receipt | set the deletion concept |
| Art. 25: by design and by default | no telemetry, AI notice in the widget, source on every answer | configure it sensibly |
| Art. 28: processors | RAGSuite Engine: DPA with RAGSuite · self-hosted: no RAGSuite processor | DPA with an external model provider, if used |
| Art. 30: records | template in the Trust Center | create and maintain the entry |
| Art. 32: security | 2FA, session timeout, audit log, no phone-home | access and roles; self-hosted also servers and backups |
| Art. 35: DPIA | DPIA template as a free tool | carry out a DPIA where needed |
No software makes you compliant automatically. Responsibility for the processing stays with you: RAGSuite removes the biggest hurdles.
What RAGSuite processes as a processor in the RAGSuite Engine.
In RAGSuite Engine we process, on your behalf, your documents, the search index, questions, answers and history, in a data centre in Germany. For this you sign a data processing agreement with us. Your data trains no model, and you decide deletion periods and storage.
Only the question and the matching passages go to the language model. You see the model provider and its location when you choose it; it is on the list of sub-processors.
Using AI in line with data protection, in eight steps.
Tick off what you’ve already clarified. Nothing is stored.
Is your company ready for AI on its own data?
- Which data may go into the index?
- What data protection and the works council need up front
- Local model or API: the deciding questions
We only use your details to reply to you. Privacy policy
What does the works council want to know about AI?
If software can analyse employees’ performance or behaviour, the works council has a say under section 87 of the Works Constitution Act. With AI assistants that is often the case. These points keep the talk short: no telemetry, storage switchable for chat and search separately, deletion periods with receipts, an AI notice in the widget and roles that decide who sees the history.
Which AI has the best data protection? Five questions for any provider.
Where is the data?
Data centre, country and the provider’s seat, not just “in the EU”.
Is my data used for training?
Is that the default, or does someone have to switch it off?
Is there a DPA?
With which sub-processors, and where are they based?
How is data deleted?
Can storage be switched off, are there deletion periods with receipts?
Can every answer be checked?
Does the AI name the source, and is there an audit log?
Who sees what?
Roles, teams and separate projects for sensitive content.
Questions about AI and data protection.
How do companies use AI in line with data protection?
Set purpose and legal basis, clarify the data flow and sign a DPA with every external provider. Check whether a data protection impact assessment is needed, limit storage and involve the works council. Our eight-step checklist helps. This is not legal advice.
What data protection problems does AI raise?
The most common are another provider processing data, transfers to third countries, answers without traceable origin and the ability to analyse employees. With some services, training on inputs adds to this. All can be solved if data flow, contracts and storage are settled before the start.
Does data leave our environment with RAGSuite?
In the RAGSuite Engine we process your data in a data centre in Germany, under a DPA. Self-hosted, documents, search index and history stay on your servers; with a local model there is no outbound traffic. Only the question and matching passages go to an external language model.
Do we need a DPIA for an AI assistant?
That depends on the risk. If the assistant processes personal data on a larger scale or special categories, a DPIA under Art. 35 GDPR is usually needed. Our free DPIA template helps with the draft. Your data protection officer decides: document the assessment before the start.
Does the works council have to agree?
If software is suitable for monitoring employees’ performance or behaviour, the works council has a right of co-determination. With AI assistants that is often the case. RAGSuite makes agreement easier: no telemetry, storage that can be switched off, deletion periods and an AI notice in the widget.
Does RAGSuite make us compliant automatically?
No, no software can, because the GDPR also covers your processes. RAGSuite removes the biggest hurdles: data in Germany or with you, deletion periods, audit log and sources are built in. Purpose, legal basis, records and impact assessment remain your job as controller.
AI on real data, with data protection on board.
Check where you stand with the free GDPR check, or go through your DPO’s questions with us.