ChatGPTAn organisation rolls out an AI tool. There is a data processing agreement, instructions have gone round and the first week goes smoothly. Then someone in support pastes a customer email with a name and an account number into the tool, because that is the quickest way to draft a reply. What makes the rollout GDPR-ready is not the contract but what you put in place after it: purpose limitation, data minimisation, a DPIA where the risk is high, clear guidance for employees and a highlight before personal data goes into the tool.
Controller responsibility in practice
When your employees use an AI tool for work purposes, your organisation is the controller for the personal data they put into prompts. That means the familiar obligations apply: lawful basis, purpose limitation, data minimisation and the rest.
The challenge is that AI tools have made it much easier to accidentally process personal data at scale. A single support team member can run hundreds of prompts per day, each potentially containing customer names, contact details or account information.
Treat AI use as an everyday working risk as well as a procurement risk. The vendor's terms matter, and so does what employees do with the tool.
DPIA: when do you need one?
A DPIA is most relevant when the use case is likely to create high risk for individuals. Practical triggers include:
- Systematic processing of special category data (health, religion, political views)
- Processing at scale that would not otherwise be subject to oversight
- Combining datasets in ways that create new risks
Not every use of ChatGPT requires a DPIA, but using it to process customer health records or employee performance data very likely does. As a starting point for your risk assessment, write down which categories of data should never go into public AI tools.
Data minimisation: the practical approach
The GDPR principle of data minimisation means using only the personal data necessary for the purpose. In a prompt, that comes down to:
- Remove identifiers that the AI does not need to complete the task
- Replace real names and addresses with generic placeholders
- Mask sensitive values like account numbers or dates of birth
Employees cannot do this on autopilot. They need a tool that shows them what is sensitive in their prompt before they submit it, so they can make the right choice there and then.
