Generative AI does not create a separate data protection regime. As soon as personal data reaches an AI system, the GDPR applies, whether the data is typed into a prompt, retrieved from internal documents or used to fine-tune a model. What changes is where the data flows and how hard it is to control afterwards.
Know where personal data enters
Map the data flows before you assess them. Typical entry points are:
- Prompts and uploaded files, often containing customer or employee details
- Retrieval sources for RAG, such as SharePoint, CRM records or support tickets
- Training and fine-tuning datasets
- Outputs, which can contain or infer personal data
- Logs, conversation histories and provider telemetry
Legal basis and purpose
Every processing purpose needs a legal basis under Article 6. For many internal uses, legitimate interest is the realistic option, but it requires a documented three-step test: a legitimate interest, necessity and a balancing of interests. The European Data Protection Board set out how to apply this test to AI models in Opinion 28/2024.
Purpose limitation under Article 5 matters most for fine-tuning. Customer or employee data collected for one purpose cannot simply be reused to train a model. Check compatibility, inform data subjects and consider whether synthetic or anonymised data would do. Where AI output leads to decisions with legal or similarly significant effects without human involvement, Article 22 applies.
Special categories need extra care
Health data, biometric data used to identify a person, and data revealing ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation fall under Article 9. Processing them requires an exception under Article 9(2) in addition to a legal basis under Article 6. HR, healthcare and customer service use cases are especially exposed. Decide whether such data may enter prompts or retrieval indexes at all, and enforce that decision technically where you can.
Minimise, pseudonymise or anonymise
Data minimisation (Article 5) and data protection by design (Article 25) mean that AI should only see the personal data it needs. Pseudonymisation, for example replacing names with tokens before a prompt is sent, reduces risk, but pseudonymised data remains personal data for anyone who can re-identify it. Anonymised data is outside the GDPR, yet true anonymisation is hard to achieve. According to the EDPB, whether a trained model is anonymous must be assessed case by case, because models can retain and reproduce training data.
- Redact or pseudonymise personal data before it reaches external models
- Limit RAG indexes to the content each use case needs, and respect existing permissions
- Set retention periods for prompts, outputs and logs
- Prefer synthetic or anonymised data for testing and fine-tuning
Carry out a DPIA where risk is high
Article 35 requires a data protection impact assessment when processing is likely to result in a high risk, for example when new technologies are combined with systematic evaluation of people or large-scale processing of special categories. Many AI use cases meet this threshold, and supervisory authorities publish lists of processing that always requires one. For high-risk AI systems, the AI Act's fundamental rights impact assessment complements the DPIA, so plan both together.
Processors and third-country transfers
Most AI providers act as processors. You need a contract under Article 28 that covers instructions, confidentiality, security, sub-processors and deletion. Check whether the provider uses your prompts or data to train its own models and how you can switch this off. Record the processing in your records of processing activities (Article 30) and document your security measures (Article 32).
If data leaves the EU or EEA, including through remote support access, the transfer rules in Chapter V apply. Rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified US organisations, or on standard contractual clauses with a transfer impact assessment. Where possible, choose EU data residency and keep a current list of sub-processors.
Fidempli helps with data flow mapping, DPIAs and technical controls, and the Fidempli platform, launching in December 2026, includes PII/PHI anonymisation and guardrails for prompts.