GDPR-compliant AI: what businesses must check.
No AI is GDPR-compliant by itself, only its use in your company can be. This guide shows which points your data protection team checks: legal basis, processing agreements, third countries, deletion and impact assessment. With a checklist to tick off.
As of 13 October 2026 · not legal advice
Key takeaways
- No provider can make you “GDPR-compliant”; responsibility stays with the company using the AI.
- Six checkpoints: legal basis, DPA, third-country transfers, deletion, impact assessment, informing data subjects.
- Health, HR and customer data and providers outside the EU are especially critical.
- Our ten-point checklist and the free GDPR check help with the review.
Which AI is GDPR-compliant?
The GDPR regulates processing, not products. Whether using an AI is lawful depends on which data you process, for what purpose, with which provider and under which contracts. The same software can be permitted in one company and not in another.
A seal or a sentence on a provider’s website does not replace this review. Facts help instead: data location, data processing agreement, list of sub-processors, deletion periods and technical measures. With these facts your data protection officer can decide.
What the GDPR requires when you use AI.
| Checkpoint | GDPR | What you clarify |
|---|---|---|
| Legal basis | Art. 6, for special categories Art. 9 | What is the processing based on: contract, legitimate interest, consent? |
| Processing agreement | Art. 28 | DPA with the AI provider and its list of sub-processors |
| Third countries | Art. 44–49 | Does data leave the EU? On what basis: adequacy decision or standard contractual clauses? |
| Storage and deletion | Art. 5(1)(e), Art. 17 | How long are questions, answers and documents kept? How is data deleted? |
| Impact assessment | Art. 35 | Is a high risk likely, for example with health or employee data? |
| Information | Art. 13, 14 | Do staff and customers know that and how AI processes their data? |
| Security | Art. 32 | Access rights, encryption, logs and protection against data leaks |
Legal basis and processing agreement: the first two questions.
For internal knowledge assistants many companies rely on legitimate interest (Art. 6(1)(f)) or on performing employment and customer contracts. For health data or other special categories you additionally need an exception under Art. 9: that is much harder.
If an external service processes the data on your behalf, you sign a data processing agreement under Art. 28. Check purpose limitation, the right to give instructions, sub-processors, audit rights and above all: whether the provider may use your inputs for its own purposes such as model training.
Data in the US: what applies to transfers.
If the provider or a sub-processor is outside the EU, that is a transfer to a third country. For the US there has been an adequacy decision since July 2023, the EU-US Data Privacy Framework. It only covers companies certified under it: check the list.
Without certification you need standard contractual clauses and a transfer impact assessment. A data centre in the EU alone does not settle the question if the provider is subject to a third country. Many data protection officers therefore prefer providers based and operating in the EU, or running it themselves.
Storage, deletion and impact assessment.
AI services often store more than expected: questions, answers, uploaded files, history and logs. Set a period for each type of data and check that the service enforces it technically, with automatic deletion and a receipt. Data subject rights such as access and erasure must also be possible to fulfil.
A data protection impact assessment under Art. 35 is mandatory if the processing is likely to involve a high risk. With AI processing employee, customer or health data that is often the case. The supervisory authorities’ list names cases where a DPIA is always required.
GDPR checklist for AI: ten points.
Tick off what you’ve already clarified. Nothing is stored.
AI and data protection in detail.
The typical problems with AI, what the works council wants to know and five questions for any provider are in our guide to AI data protection. It also explains how RAGSuite handles these points.
Questions about GDPR-compliant AI.
Which AI is GDPR-compliant?
No AI is GDPR-compliant by itself, because the GDPR regulates processing, not products. What matters is how you use the AI: with which data, for what purpose, under which contract and where the data is stored. Assess providers by facts such as the DPA, location and deletion periods.
Do I need a data processing agreement for AI?
Yes, if an external provider processes personal data on your behalf. The agreement under Art. 28 GDPR covers purpose, instructions, security and sub-processors. Check in particular whether the provider may use your inputs for its own purposes such as model training. If you run the AI yourself, this agreement is not needed.
May personal data go into an AI chat?
Only with a legal basis, a contract with the provider and a clear rule on which data is allowed. With public chat services without a company contract, staff should not enter personal data. Put this in an AI usage policy and train your team. Our template for it is free.
Is an AI with servers in the EU automatically GDPR-compliant?
No. A data centre in the EU helps but does not settle every question. It also matters where the provider is based, which law it is subject to and where its sub-processors work. Then come the legal basis, DPA, deletion and impact assessment, which you must settle yourself as controller.
When is a DPIA needed for AI?
A DPIA under Art. 35 GDPR is needed if the processing is likely to involve a high risk for data subjects. With AI processing health, employee or extensive customer data that is often the case. Check your supervisory authority’s list and document it even when you decide not to carry out a DPIA.
Is this guide legal advice?
No. The guide explains the GDPR duties when using AI in plain language and names the relevant articles. It does not replace a review by your data protection officer or a law firm. Use the checklist and the free GDPR check to prepare for that conversation.
Check your AI use in ten minutes.
The free GDPR check asks nine questions and shows where to improve. Or try RAGSuite free for 7 days.