AI Governance, Privacy & AI Security
A clear legal basis, a DPIA where needed and technical controls for every AI use that touches personal data.
The problem
Personal data reaches AI through many routes: prompts and uploads, documents indexed for retrieval (RAG), training and fine-tuning data, logs kept by the provider. Each route is processing under GDPR, and many are not in any record.
Data protection officers are asked to approve AI tools without knowing where the data goes, who the processor is or whether it leaves the EU. Without that picture, every new AI use becomes a delay or a gamble.
What we do
For each AI use we trace which personal data goes into prompts, uploads, retrieval indexes, training data and logs, and where it is stored and processed.
We set the purpose and legal basis under Articles 5 and 6, identify special categories of data under Article 9, and check where automated decisions under Article 22 may arise.
We screen each AI use for the need for a data protection impact assessment under Article 35 and carry it out where required, with risks and measures documented.
We review the AI providers' data processing agreements under Article 28, their use of your data, retention and transfers outside the EU under Chapter V.
We add each AI use to your records of processing activities under Article 30, so the record reflects how AI is actually used.
We design data protection by design under Article 25 and security of processing under Article 32: minimisation, pseudonymisation, access control on retrieval and retention limits.
How we deliver
Our privacy consultants assess your AI uses, carry out DPIAs and advise your data protection officer and business owners on each decision.
Our engineers implement the safeguards in your environment, such as sensitivity labels, data loss prevention, access control on RAG sources and pseudonymisation.
We review new AI uses, keep DPIAs and the records of processing current, and monitor how personal data flows into AI tools as a managed service.
Frameworks
Platform
When the Fidempli platform launches in December 2026, it applies the result in daily use: personal and health data is pseudonymised or removed before any AI model sees it, and each DPIA stays linked to the AI system it covers.
Explore the platform
Only where there is a purpose, a legal basis and a provider contract that fits. We help you set clear rules per tool and add technical controls, so the rule does not depend on memory alone.
No. Article 35 requires one where processing is likely to result in a high risk to people. Many AI uses, such as profiling, HR decisions or large-scale processing of health data, typically meet that bar. We screen each use and document the outcome either way.
That depends on the product, the contract and the settings. We review the terms and configuration of each provider and record what applies.
Documents indexed for retrieval and data used for training or fine-tuning are processing too. We check purpose, minimisation and access control, so the AI only returns what the user is allowed to see.
AI-specific knowledge of how copilots, agents and RAG systems handle data, plus engineers who implement the controls. Your data protection officer stays in charge of the decisions.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
