Using ChatGPT in your business, GDPR-compliant: what to know

Yes, ChatGPT can be used GDPR-compliant in a business with a business or API plan that includes a data processing agreement, clear internal rules on what data may be entered, and a short training session for your team. Personal data generally does not belong in free consumer accounts.

In this article we explain the differences between the plans, what a data processing agreement needs to cover, what duties the EU AI Act brings, and give you a template for an internal policy.

#Consumer, business or API, which plan fits?

The three common types of access differ mainly in how your data is handled.

#What does a data processing agreement need to cover?

If you use an AI tool that processes personal data, Article 28 of the General Data Protection Regulation (GDPR) requires a data processing agreement with the provider. It should cover, among other things:

• The purpose and scope of the data processing
• Whether and how data may be used for training
• Retention periods and deletion timelines
• Where the data is processed (inside or outside the EU)
• Security measures and duties to report data breaches

Without such an agreement, processing personal data through the tool is generally not permitted.

#Data minimisation: what should you actually enter?

Even with a suitable agreement in place, the rule still holds: only enter the data that is genuinely necessary for the specific task.

• Low risk: general text drafts, summaries with no names, internal process questions.
• Caution needed: customer data, health data, contracts with sensitive clauses, internal HR data.
• Generally avoid: special categories of personal data (health, religion, political opinion) without an explicit legal basis and a suitable agreement.

A simple rule of thumb: if you wouldn't put the information in a public email to an unknown provider, it doesn't belong in an AI tool unchecked either.

#EU AI Act: what does the AI literacy duty mean for you?

The EU AI Act (Regulation (EU) 2024/1689) requires, under Article 4, that providers and deployers of AI systems ensure their staff have sufficient AI literacy, applicable since 2 February 2025. In practice that means:

• Employees who use AI tools should understand the basic way they work, their possibilities and their limits.
• A short internal training session or a guide is enough for most small businesses.
• Requirements scale with role, prior knowledge and context of use, a call centre agent using an AI chatbot needs different knowledge than a managing director occasionally drafting text.

#Template: internal AI usage policy (bullet points)

A short, understandable policy helps more than a long document nobody reads. As a starting point:

1. Approved tools: which AI tools are approved, and for what purposes?
2. Approved data: which types of data may be entered, and which may not?
3. Review duty: AI output is always checked by a person before use.
4. Disclosure: where AI-generated content is published, this is made transparent.
5. Point of contact: who answers questions about data protection and use within the company?
6. Incident reporting: how are accidental entries of sensitive data reported?

#Checklist: introducing ChatGPT GDPR-compliant

• A business or API plan with a data processing agreement is chosen, not the free consumer account
• An internal policy on approved data and tools is written
• The team is trained on the basics, possibilities and limits of AI (an AI Act duty)
• A review process for AI-generated content is in place before publication
• The works council is involved, where one exists
• A point of contact for data protection questions is named

#Don't forget co-determination and internal alignment

Beyond data protection and AI Act duties, there's another point often overlooked in practice: internal co-determination. In companies with a works council, introducing AI systems can require co-determination, particularly where it enables monitoring employee behaviour or performance, for example with systems that log or evaluate workflows.

Clarify this early, not shortly before rollout:

• whether, and to what extent, the works council needs to be involved;
• what data about employees the system might capture or evaluate;
• how you'll create transparency with the team before a tool becomes mandatory to use.

Early, open communication prevents resistance within the team and later legal disputes.

#How do you choose the right provider?

Besides ChatGPT, there are other providers of AI language models with different data protection approaches. These questions help with the choice.

• Where is the data processed? Data processed within the EU often simplifies the data protection assessment, but it's not a free pass, a data processing agreement is still needed there too.
• How transparent is the documentation? Reputable providers disclose their data protection practice clearly and keep it current, not just in general marketing claims.
• Is there room for contractual adjustment? Larger companies can often negotiate individual contract terms; smaller ones usually work with the provider's standard contracts.
• How easily does the tool fit into existing workflows? A technically impressive tool is of little use if your team doesn't use it because it's too complex.

#Conclusion: clear rules instead of avoidance or a free-for-all

ChatGPT and similar tools can be used GDPR-compliant in small and mid-sized businesses, the requirement is the right plan, clear internal rules and a trained team. That is not an obstacle; it is the difference between a productive tool and a quiet risk.

Want to introduce AI automation in your business in a data-protection-compliant way? More on our approach is on the AI & automation page, or get in touch with us directly. For concrete use cases to get started, see our article AI for small businesses: which tasks can AI actually take over?

#Sources

• EUR-Lex: Regulation (EU) 2024/1689 (EU AI Act)
• EUR-Lex: General Data Protection Regulation (GDPR)