GDPR check for AI: how ready is your company?
Nine questions, three minutes: the check shows where your company is well set up on data protection for AI and where the gaps are. You get a next step for every gap. Your answers stay in your browser.
Not legal advice · as of 13 October 2026
Your result and the next steps.
As soon as you’ve answered every question, your result appears here: the share of points met, your gaps and a next step for each gap.
Guide: GDPR-compliant AI →See the RAGSuite Engine →Request a call →
Email me the result
Optional: we send you the result. Otherwise your answers only stay in your browser.
What is a GDPR check for AI?
A GDPR check for AI is a structured self-assessment before you use AI on real company data. It covers what data protection officers and works councils ask first: where does the data run? Is there a legal basis? Who sees what, and how is data deleted?
The result is not a certificate but a list of open points for your project, with a next step for every gap.
Nine questions for your AI data protection check.
Data location
Do you know and control where the AI processes your data?
Legal basis and DPIA
Is the legal basis settled and have you checked whether an impact assessment is needed?
Processing agreements
Is there a DPA under Art. 28 with every processor?
Works council
Is the works council involved if staff use the system?
Data selection
Do you control what is ingested and leave out what is not needed?
Deletion
Can you enforce periods and honour deletion requests?
Transparency
Can users recognise the AI and the source of every answer?
Logging
Are access and changes logged in a traceable way?
Human oversight
Does a person review before consequential decisions?
What does your score mean?
| Score | Meaning | Next step |
|---|---|---|
| 80–100% | A good starting point | Close the remaining points and document your decisions |
| 50–79% | A solid base, some gaps | Close the gaps before real data goes into the AI |
| 0–49% | Sort out the basics first | Talk to your DPO before personal data is processed |
“Yes” counts in full, “Partly” half, “No” nothing. “Not relevant” is left out. A self-assessment, not legal advice.
The right way to run it closes many gaps.
In RAGSuite Engine, platform and data run in a data centre in Germany, under a data processing agreement. Self-hosted, everything stays on your servers and the platform adds no new processor. Both ways include an AI notice in the widget, a source on every answer, deletion periods with receipts and an audit log.
Our clients in the housing sector cannot send tenant data to a US cloud. RAGSuite lets us give them a real AI assistant that never leaves their building.
Questions about the GDPR check.
How long does the GDPR check take?
About three minutes. You answer nine questions with yes, partly, no or not relevant. Then you see your score in percent, your gaps and a next step for every gap. You can restart the check at any time, for example after you have settled individual points.
Is the result a certification?
No. The check is a self-assessment, not a seal. It shows which points are open before you use AI with real data. Your data protection officer makes the legal assessment. The result works well as a basis for that conversation and as part of your documentation.
Are my answers stored?
No. The check runs entirely in your browser. Your answers are not transmitted to us or to third parties. If you want the result by email, you give your address voluntarily and consent. Without that step, nothing leaves your computer.
What do I do with the gaps?
Every gap has a next step, such as signing a DPA, setting deletion periods or involving the works council. Work through the points with your data protection officer. For documentation, the free DPIA template and the AI policy help; for an overview, the guide to GDPR-compliant AI.
Does the check also apply to RAGSuite Engine?
Yes. The check is provider-neutral and works for any AI solution. For the RAGSuite Engine you answer the DPA question, for example, with the agreement you sign with RAGSuite. Self-hosted, there is no processor for the platform. The other questions concern your own processes.
Found gaps? We go through them with you.
Try RAGSuite free for 7 days in the RAGSuite Engine, or talk to us about your DPO’s questions.