GDPR and data protection
Personal data in prompts, uploads and agent actions is still personal data. Fidempli finds where it goes, removes or pseudonymises it before it reaches a model, and records why.
How Fidempli handles it
| Requirement | How Fidempli handles it | Capability |
|---|---|---|
| Lawfulness and purpose limitation (Art. 5, 6) | Each AI use is registered with its purpose and owner before it goes live | Intake and approvalAI inventory |
| Special categories, such as health data (Art. 9) | Health data is detected and removed or pseudonymised before any model sees it | PII and PHI protection |
| Data protection by design (Art. 25) | Guardrails apply one policy to every AI provider | Real-time guardrails |
| Security of processing and pseudonymisation (Art. 32, 4(5)) | Re-identification keys kept in an EU vault with access for the DPO only | PII and PHI protection |
| International transfers (Art. 44) | Unapproved AI apps that store data outside the EU are found and can be blocked | Shadow AI |
| Impact assessment (Art. 35) | DPIA tracked as an obligation for each AI system that needs one | Compliance mapping |
Choose per field whether data is pseudonymised, generalised or removed, and see exactly what the model received.
Related services
Consulting
GDPR for copilots, agents and AI applications: from DPIA to data in prompts, RAG and training.
Learn moreProfessional services
Install, configure and connect the Fidempli platform to your AI providers, identity and data.
Learn moreManaged services
We run AI intake, monitoring, evidence and board reporting for you, ongoing.
Learn moreFidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
Our consultants assess where you stand; the platform keeps it current.
