AI and GDPR: what a business must watch out for.

Five questions to ask

1. What personal data does the agent process? Names and email addresses? National ID numbers? Health data?
2. On what legal basis? Most often performance of a contract, a legal obligation or legitimate interest (Art. 6 GDPR).
3. Who is the processor? The AI service provider and the agent supplier both process data on your behalf – you need a data processing agreement with them (Art. 28).
4. Where is the data processed? Inside or outside the EU? A transfer outside the EU needs a legal framework.
5. How long is the data kept and who has access to it?

Contracts with AI providers

Major providers of language models offer terms for business and API use in which they commit not to use customer data to train their models, along with data processing addenda (DPAs). This often does not apply to free versions of public chat tools.

A practical rule: do not paste clients' personal data into free public chat tools. For business use, choose services with a contract and a clearly defined place of processing.

Transferring data outside the EU

Many AI services run on servers in the USA. A transfer is possible, for example, under the EU–US Data Privacy Framework if the provider is certified, or under standard contractual clauses. Many providers now also offer processing in EU data centres. When designing an agent, it is worth making this decision deliberately.

Automated decision-making

Article 22 GDPR gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on them (e.g. rejecting an application, selecting a job candidate). That is why, for such steps, the agent prepares the groundwork and a person decides.

When a DPIA is needed

A data protection impact assessment (Art. 35) is required where processing is likely to result in a high risk to people's rights. With AI, this typically applies to large-scale processing of sensitive data (health), systematic evaluation of people, or the use of new technologies on a large scale. Simple sorting of business mail usually does not require one, but it is good practice to document that conclusion.

A practical approach to deploying an agent

• Describe what data the agent sees and why.
• Limit access to the folders and systems it actually needs (data minimisation).
• Sign data processing agreements with suppliers.
• Choose where processing happens (EU / outside the EU) and document the legal framework.
• Update your records of processing activities and the information given to data subjects.
• Decide what a person must approve.

The supervisory authority in the Czech Republic is the Office for Personal Data Protection (ÚOOÚ). We cover the link to the EU regulation on AI in our article on the AI Act.

This article is a general overview, not legal advice. For sensitive processing, we recommend consulting your data protection officer or a lawyer.

Frequently asked questions