Your team probably already uses ChatGPT, Gemini or Copilot, even if nobody officially decided it. It is useful, but pasting customer data into a tool without checking its terms can breach the GDPR. These six rules reduce the risk without banning anything.
1. Use business versions
Free or personal versions of some tools may use your conversations to train their models unless you switch it off. Business versions usually exclude this by default and include a data processing agreement. Check the settings and terms of the tool you use.
2. Don't paste personal data unless you need to
To draft an email or summarise a contract, AI rarely needs the customer's name, ID number or phone number. Replace them with "Customer A" or "[name]". It is the simplest and most effective measure.
3. Never sensitive data
Health data, bank details, passwords or information about children should not go into a general-purpose generative AI tool.
4. Sign the processing agreement
If the tool processes your customers' personal data, the provider acts as a processor. Article 28 GDPR requires a contract with them. Business versions usually offer one: download it and keep it.
5. Check where the data goes
Many providers are based in the United States. Transfers are lawful if the provider is certified under the EU-U.S. Data Privacy Framework or uses standard contractual clauses. Check their privacy policy.
6. Write a one-page internal rule
Which tools are allowed, which data must not be entered and whom to ask when in doubt. One page the whole team reads is worth more than a manual nobody opens. It also helps you meet the training duty under the EU AI Act.
Always check the output
AI makes mistakes too, and it makes them with complete confidence. An email with a wrong figure or a summary that misses an important clause is your business's responsibility, not the tool's. Whoever sends it, checks it.
This article is for information only and is not legal advice.