AI Act and GDPR: using personal data in AI
A practical guide to data entered into AI systems: purpose, GDPR lawful basis, minimisation, vendors, retention, rights and risk assessment.
AI ACT · DATA PROTECTION
The AI Act and GDPR are not alternative checklists. The former addresses the AI system, its roles and risks; the latter applies when that system processes information about people. In a real project, both assessments meet in the same prompt, log and workflow.
The AI Act does not provide a GDPR lawful basis
Meeting an AI Act transparency duty, inventorying systems or classifying risk does not automatically authorise the collection of personal data. Each processing operation still needs its own purpose, applicable lawful basis, necessity assessment, notice, retention period and recipients. An “AI Act” tick does not replace that work. [EU-REG] [EDPB-28]
EDPB Opinion 28/2024 explains that legitimate interest requires a contextual three-step test. It also says model anonymity cannot be assumed: identifying people whose data was used for development, or extracting their personal data through queries, must be very unlikely. [EDPB-28]
Map the data before mapping the API
Start with four zones: input, context, output and logs. Inputs may include names, email or conversation; context may come from a CRM, documents or history; output may infer information about a person; logs may retain all of it at the vendor and in your infrastructure. Record source, purpose and access for each field. [EU-REG] [OAI-DPA]
Separate data necessary for the result from data included merely for convenience. Summarising a request may require case context, but not a national identifier, password or the customer’s full history. Use pseudonyms, temporary identifiers and pre-model filtering where directly identifying information does not change the outcome. [EDPB-28] [OAI-DPA]
A vendor contract does not solve product design
OpenAI states that, by default, it does not train on inputs or outputs from the API and business products unless the organisation explicitly opts in to sharing. That matters, but it does not mean “no processing occurs” and does not establish the purpose or lawful basis of the company sending the data. [OAI-DATA]
OpenAI’s DPA covers processor duties, breach assistance, return or deletion after termination, transfer mechanisms and the customer’s responsibility for necessary notices and authorisations. It also leaves certain configuration choices, including retention and deletion, to the customer. Read the contract together with the actual configuration. [OAI-DPA]
Review the sub-processor chain and transfers
OpenAI’s 9 July 2026 list shows different sub-processors by product and purpose, with processing locations across several regions. The DPA provides change notice and an objection window. Vendor review should retain the version examined, products used and relevant transfer mechanism. [OAI-SUB] [OAI-DPA]
Do not copy the list into a policy and forget it. Subscribe an owner to notifications, define reassessment criteria and connect vendor changes to both the AI inventory and GDPR record. A new sub-processor, region or enabled connector can alter the data path without changing the visible interface. [OAI-SUB] [EU-REG]
Data-subject rights must work technically
An access or deletion procedure is useless if the team cannot find the prompt, log, vector, file and output linked to the same person. Decide at design time which identifier enables search, which copies exist, what can be corrected and where deletion must propagate. Avoid unsearchable archives merely because storage is cheap. [EDPB-28] [OAI-DPA]
Distinguish data held only in application context from data that might be memorised or reflected by a model. The EDPB calls for case-specific analysis of model anonymity and unlawfully processed data. Do not promise deletion from a model unless architecture and contract can support that promise. [EDPB-28]
The minimum use-case approval record
Before launch, record purpose, people and data categories, source, assessed lawful basis, controller/processor roles, product and region, sub-processors, retention, access, filtering, notice, rights mechanism, tests and internal owner. Add the next review date and any event that triggers an earlier review. [EU-REG] [EDPB-28] [OAI-DPA] [OAI-SUB]
For an SEO workflow, WordPress agent or support assistant, the practical rule is the same: do not send more to the model than you could explain to the person in one clear sentence. If you cannot explain why a field is necessary, remove it or delay launch until purpose and control are real. [EDPB-28] [EU-REG]