AI and GDPR: where your company data actually goes (and how to keep control)

"If I use AI, does my customer data end up somewhere I can't control?" It is the question I get most often, usually whispered at the end of a call as if it were embarrassing. It is not: it is the right question, and the honest answer is that it depends entirely on how the system is built. With identical features you can have a setup that stands up to a privacy review, or one that clearly does not.

The part almost nobody explains

Using ChatGPT in a browser with a personal account and using a model through an API inside a business system are two different things from a data standpoint. In the first case, what you paste follows the account settings and plan policy, and you have no technical control over what is retained. In the second, you define the flow: which fields leave, which stay in-house, how long anything is kept, where logs live. The risk is not AI itself — it is thirteen employees pasting contracts and customer records into personal tools with nobody knowing.

The three setups I use in real projects.

• Cloud with minimised data: models are called via API, but before sending, the system strips or pseudonymises anything the task does not need — names, tax codes, bank details, addresses. This is the most common setup and fits the large majority of cases.
• Hybrid: documents stay in your own storage; the model only receives the fragment of text needed to answer, never the whole archive. Typical for internal assistants over manuals, procedures and contracts.
• Fully local: self-hosted n8n and models running on your own server. No data leaves your infrastructure. It costs more in hardware and maintenance and local models are weaker than the best cloud ones, so it makes sense when the constraint is regulatory or contractual, not as a matter of principle.

What GDPR compliance actually requires

Five practical things: a legal basis for the processing; the AI vendor appointed as processor with the corresponding agreement; the records of processing updated to include AI use; a customer privacy notice that matches reality; and a written internal policy telling employees what they may and may not paste into an external tool. The last one costs nothing and is the one most often missing.

And the AI Act

For the vast majority of SMB uses — customer support, internal automation, document analysis — you fall under limited or minimal risk: the main duties are transparency (telling people they are talking to an automated system) and basic AI literacy for the staff using the tools. High-risk categories cover specific areas such as recruitment, credit scoring and health: if your project touches those, it must be assessed before a single line of code.

How I verify it in a project

I draw a one-page map: which data enters the flow, what leaves the company, to which vendor, how long it is kept, who can see it. If that page does not exist, the project is not ready for production, however well the demo performs.

If you want to know which of the three setups fits your case, we can go through it in a free 15-minute call: what can stay in-house, what is fine to send out, and what needs to be written down before you start.