AI and GDPR: what can you really entrust to ChatGPT or Copilot?
The dangerous reflex: copy and paste without thinking
"Can you summarise this contract?" — and off goes a confidential document to the servers of an American vendor. This harmless-looking gesture is now one of the leading causes of data leaks in companies. Not because AI is malicious, but because nobody asked where the data goes and what happens to it.
What the GDPR says (in plain terms)
The GDPR does not prohibit the use of AI. It requires that any processing of personal data (name, email, address, customer number, health data…) rests on a legal basis, is limited to what is necessary, and that the providers processing that data on your behalf are bound by a data processing agreement (DPA).
The direct consequence: using the free version of a chatbot with customer data, with no contract or guarantees, puts you in an awkward position. A business plan with a DPA, clearly identified hosting and a commitment not to reuse your data changes everything.
Three levels of data, three attitudes
| Type of data | Examples | Acceptable tool |
|---|---|---|
| Public / no stakes | Website text, job ad, generic email | Any assistant |
| Internal | Procedures, sales offers, minutes | Managed business plan (DPA) |
| Sensitive | Health data, payroll, legal files, trade secrets | Strict anonymisation or local AI |
Good practices that are enough in 90% of cases
- Anonymise: replacing "Mr Dupont, 12 Rue de la Station" with "customer A" takes only a few seconds.
- Turn off history / training when the tool allows it.
- Use business accounts, never personal ones, to stay in control of access.
- Document the use of AI in your record of processing activities if personal data is involved.
- Inform your staff with a simple policy (see our article on shadow AI).
And for truly sensitive data?
For a medical practice, a law firm, an HR department or an accountant, the most reassuring solution is often to run the AI on your own hardware. No data leaves your premises, and the question of transfers outside the European Union disappears. Recent "open" models perform well enough to summarise, rephrase or query internal documents. We explain how in An AI installed on your premises, without the cloud.
Taking stock of your situation
We help you classify your data, choose the right tools for each level and write the corresponding usage rules — without unnecessary legal jargon. For strictly legal questions, we work alongside your adviser or DPO.