GDPR and AI tools: a checklist for small businesses

Before you start: what this checklist is

This article is general information about the GDPR, not legal advice. What applies to you depends on your industry, the data you process and the tools you use. If you process sensitive data or are unsure, talk to your data protection officer or a lawyer who specialises in data protection.

Most questions are the same ones you should already ask about any cloud software. AI tools add a few points of their own, which are covered below.

Data processing agreement (Art. 28 GDPR)

If a provider processes personal data on your behalf, for example customer names, e-mail addresses or invoices stored in an AI platform, you generally need a data processing agreement under Article 28 GDPR. It sets out what the provider may do with the data, which technical and organisational measures apply and which sub-processors are involved.

Check: Is there a data processing agreement, and have you concluded it? Does it list the sub-processors? Does the provider state whether your data is used to train models, and can you rule that out?

Data minimisation and purpose

Only give a tool the data a task actually needs. A sales analysis by product rarely needs customer names, and a market analysis usually needs no personal data at all. Where possible, work with aggregated or pseudonymised data.

Be clear about the purpose as well. Data you collected to send invoices cannot automatically be used for any other purpose. Write down what you use the AI tool for and add it to your record of processing activities.

Where the data goes: transfers to third countries

Ask where data is stored and where it is processed; these can be different places. Many AI services are operated by US companies. Transferring personal data outside the EU requires a legal basis, typically an adequacy decision or the EU standard contractual clauses, often combined with additional safeguards.

Check: In which country is the data stored? Which processing services are located outside the EU, and on what basis is data transferred to them? Is this stated in the privacy policy and the data processing agreement? For transparency: NEXUM stores data in a database in Ireland, in the EU; some of the processing services we use are US companies, with EU standard contractual clauses in place.

Special categories and professional secrecy

Health data belongs to the special categories of personal data under Article 9 GDPR and is subject to stricter rules. A medical or therapy practice should think carefully before putting patient data into any AI tool; often the right answer is to use only anonymised or aggregated data.

Doctors, lawyers, tax advisers and other professions bound by confidentiality have additional duties, in Germany notably under section 203 of the Criminal Code. Involving an external service provider can be permissible under certain conditions, but it has to be checked and documented. This is a point where professional advice is worth it.

Access rights, deletion and internal access

People can ask what data you hold about them (Article 15 GDPR) and, under certain conditions, request its deletion (Article 17 GDPR). Make sure you can find, export and delete a person's data in the AI tool as well, not only in your main systems.

Define deletion periods: how long do you keep documents, drafts and analyses that contain personal data? Statutory retention obligations, for example for invoices, still apply. Inside the company, decide who may use the tool and with which data, and restrict access accordingly.

Finally, be wary of claims you cannot verify. Ask providers for the data processing agreement, the list of sub-processors and a description of their security measures in writing. We hold ourselves to the same standard and state openly that NEXUM is not certified under ISO or SOC standards.