Business accounts instead of personal ones, checked settings and a clear list of what not to paste into an AI assistant. A minimum rule set, on one page.
Anyone in the company can open ChatGPT, Claude or Gemini in five seconds and paste in a customer’s email, a contract or a spreadsheet of orders. That ease is exactly the problem: customers’ personal data ends up in a service the company has not assessed and has no contract with. This article explains, in plain terms for an owner, what GDPR changes about using AI assistants and what you can do in practice. It is not legal advice; for your own case, speak to a lawyer or to your data protection officer if you have one.
Why it matters: you remain responsible
Under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the company that decides why and how customer data is processed is the controller. The AI service provider is usually a processor when it processes data for you. Responsibility towards the customer remains yours, and the relationship with the provider has to be covered by a processing contract (Article 28).
If an employee uses a free personal account for work, there is no such contract and no control for you over the data.
The account matters: personal or business
Providers treat consumer and commercial accounts differently. Anthropic, for example, states that by default it does not use inputs and outputs from its commercial products (team and organisation plans, the API) for training, unless you submit feedback or explicitly opt in. Personal accounts have separate rules, which may allow conversations to be used to improve models depending on settings. Other providers have their own policies, so read each one’s terms rather than assuming.
What to check on a business plan:
- there is a data processing agreement (DPA) you can sign;
- what happens to the data: training, retention, who on the provider’s team can see it;
- where the data is processed and on what basis transfers outside the European Economic Area are made;
- administrator controls: company-managed accounts, central sign-in, the ability to delete history.
There is no universal guarantee. In our projects we configure integrations so that data is not used for training, but each provider’s contract and settings still have to be read.
What not to paste into an assistant
The GDPR principle is data minimisation (Article 5): you use only what you need. Applied here, it becomes a simple rule you can pin up in the office. Do not paste:
- full identification data (national ID number, ID document details, full address, bank account number) if the task can be done without them;
- special-category data (health, beliefs, biometric data and others in Article 9) without prior assessment;
- the content of a complaint or dispute with real names;
- passwords, API keys, system access;
- confidential partner documents covered by confidentiality clauses.
Far more often than you would think, the task can be done once you replace names with labels (“Customer A”) or delete unnecessary fields. A summary of a complaint does not need the customer’s phone number.
Legal basis and information
Any processing needs a legal basis (Article 6) and the person must be informed (Articles 13 and 14). If you use AI for the same purpose as before, for example summarising customer messages in order to reply, the existing privacy notice often covers the purpose, but you may need to mention recipients (the AI provider) and any transfers. If you use the data for a new purpose, a new assessment is needed. This is where a lawyer is worth it.
Transfers outside the EU
Many AI providers are outside the EU. GDPR allows transfers only on the bases set out in Chapter V, such as an adequacy decision or standard contractual clauses. Ask the provider what the basis is for transferring your data and whether it offers processing in an EU region.
Impact assessments and automated decisions
For processing that is high-risk for individuals (large-scale monitoring, profiling, sensitive data) GDPR requires an impact assessment (Article 35). And Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects on a person. An AI that “rejects” customers’ or candidates’ applications on its own falls into this area; keep a person in the loop.
Incidents
If a mistake leads to data being exposed (for example, a document sent to the wrong account), GDPR provides for notifying the authority, generally within 72 hours of becoming aware, if the incident poses a risk to individuals (Article 33). The authority in Romania is ANSPDCP. Decide from the start who tells whom inside the company.
A minimum set of rules, on one page
- Only company-approved accounts and tools are used, with work accounts rather than personal ones.
- A DPA is signed with every provider that receives personal data.
- Privacy settings are checked by an administrator, not left to individual choice.
- The “what not to paste” list is known to everyone.
- Data is anonymised or pseudonymised whenever the task allows.
- AI output is checked by a person before it reaches a customer.
- Someone in the company is responsible for the tool list and keeping it up to date.
This page, plus a short training session, covers a good part of what both GDPR and the AI literacy duty we wrote about in the previous article require.
If you want help choosing and configuring tools, ME Digital provides AI implementation for small businesses, with clear usage rules; you can start with a conversation on the contact page.