Turning GDPR duties into a workable AI rollout, not a blanket ban.
The GDPR doesn't ban workplace AI, but it does require a lawful basis, data minimisation, and control over where personal data goes. Regulators put the responsibility on the employer, so the practical answer is to allow AI and keep personal data out of tools that shouldn't hold it.
When someone pastes personal data into an AI tool, the GDPR still applies. The law doesn't care whether the recipient is a colleague or a chatbot. That raises real questions about lawful basis, data minimisation, processor agreements, and where the data is actually stored.
Regulators have been clear about where the duty sits. The Dutch data protection authority points to the employer: it's the organisation's job to set clear rules for AI use and make sure people follow them, not the individual employee's. The EU AI Act adds another layer, phasing in from 2025, though for most teams the day-to-day risk is still ordinary personal data going into ordinary chatbots.
Banning AI tends to backfire into shadow use on personal devices. A more defensible position is the opposite: allow AI, write it down, and put a check in place so personal data doesn't cross the line in the first place.
These guides translate GDPR duties into a practical rollout: what belongs in policy, how to handle employee AI use, and the controls that keep you aligned with the rules without slowing people down.
Articles in this topic
An AI notetaker records, transcribes and summarises your meeting. The GDPR allows that, provided you know why, everyone knows it is happening and the recording does not outlive its purpose.
Read the article
When generative AI at work calls for a DPIA, which EDPB criteria count, what goes into it and why a DPIA can describe the measures but cannot prove them.
Read the article
Days before 2 August 2026, Brussels pushed the high-risk deadlines back to 2027 and 2028. What still goes ahead, and the full timeline in one place.
Read the article
An AI policy on allowed tools needs consultation; a measurement that can observe behaviour needs works council consent. Where the line falls, and why.
Read the article
Most AI policies cover what people type, rarely the case file or spreadsheet someone uploads whole. Why that gap matters and what closes it.
Read the article
A summons pasted into a free ChatGPT account: what happens to it, what a business account does and does not change, and what to take out first.
Read the article
Which GDPR basis fits measuring AI use and showing notices, why employee consent usually does not and how the three-step balancing test works.
Read the article
An AI policy that gets read fits on one page. Here is an example with eight rules people can follow straight away, and why each one is there.
Read the article
HR handles the most sensitive data an organisation holds. Seven rules for using AI on CVs, absence and appraisals, and what tool settings do not solve.
Read the article On a work account your employer can often see your ChatGPT or Claude chats, and a managed laptop or office network shows more. What each layer reveals.
Read the article
The organisation wants to know which AI tools are in use; the employee does not want to be tracked. Why there is no trade-off: answering the question requires no names.
Read the article
What a GDPR-ready rollout of AI tools takes: controller responsibility, a DPIA where needed, data minimisation, clear guidance and a highlight before anything is sent.
Read the article The sector DPIA describes the service; yours describes how you use it: permissions, data, connections, measures and how you will later show they are working.
Read the article The AI Act and the GDPR apply side by side: one covers personal data, the other the AI system. Which dates count, and what most organisations need to do now.
Read the article An employer can check whether staff use AI, but not freely. The GDPR sets conditions on purpose, proportionality and openness; works councils have a say.
Read the articleYes, as long as there's a lawful basis, the personal data is kept to a minimum, and it's processed under appropriate agreements and safeguards. The GDPR governs how, not whether.
It can be. Without a lawful basis or processor agreement, and with data exposed to training or third parties, regulators may treat it as a personal data breach. Keeping personal data out of the tool removes the question.
Mainly the employer. Supervisory authorities expect the organisation to set clear guidelines for AI use and ensure staff follow them. Clear policy plus a practical control is the defensible position.
Sensitive data gets a marking while you type, in the tools your team already works in. You decide what happens before you send.
Rens, BeeSensible
I'm happy to give you a twenty-minute tour. Leave your details and I'll find a time that suits you. You're also welcome to call or email.