GDPR and Generative AI at Work: A Guide for the DPO

Business use of generative artificial intelligence falls under the GDPR (Regulation (EU) 2016/679) whenever an assistant processes personal data: a name in an email to be summarized, a contract containing counterparty details, a CV to be compared, a support ticket to be classified. This article is informational and is not legal advice: its purpose is to frame the right questions with the DPO and with legal counsel.

When does a generative assistant process personal data?

A generative assistant processes personal data when a person types or pastes information into the prompt, when they upload files or link them from company repositories, and when the output contains or reconstructs information about identifiable people. Histories and logs can also contain employees' personal data.

The scope is decided per use case. Summarizing a technical document with no references to people is one thing; analyzing customer messages is another. The first step is knowing which tools are in use and for what purposes.

Which legal basis applies to generative AI processing?

Every processing activity needs a legal basis from those in article 6 of the GDPR. The company identifies it for each purpose, not for each tool. An assistant that helps draft replies to customers is normally tied to the same basis as the underlying processing (performance of a contract or legitimate interest); a new use, such as analyzing conversations to train models, requires its own assessment.

If the basis is legitimate interest, the balancing against people's expectations must be documented. Data collected for one purpose cannot be reused with an assistant for different purposes without checking compatibility. Consent is rarely suitable in employment relationships, because of the imbalance between the parties: this is an assessment to share with legal counsel.

What changes for privacy notices?

Articles 13 and 14 require informing people about purposes, legal basis, recipients and transfers. If a generative assistant becomes part of the processing, the notice must reflect reality: the vendor appears among the recipients or categories of recipients, and the purposes must cover the actual use.

In practice, the notices to customers and suppliers, the notice to employees and the record of processing activities need review, on a fixed schedule because active features change. The same goes for the transparency obligations of the EU AI Act (Regulation (EU) 2024/1689) when a person interacts with an AI system: the two layers overlap and are best managed together.

How does data minimization apply to prompts?

Article 5 requires data to be adequate, relevant and limited to what is necessary. In prompts this clashes with the habit of pasting everything: emails with signatures and contact details, complete contracts, spreadsheets with unnecessary personal columns.

Concrete minimization measures:

1. Define in the policy which categories of data must never be entered into assistants, or only into approved tools.
2. Pseudonymize or remove identifying data before sending, when the purpose allows.
3. Limit connectors to company repositories to those strictly needed, with permissions consistent with the users' own.
4. Train people on real examples from their own role, not abstract rules.

A well-written policy reduces the problem at the source: see the article on how to write a company AI policy.

Is the assistant vendor a data processor?

In typical business use, the company is the controller and the vendor is the processor: it processes data on the company's behalf and on its instructions. Article 28 requires a contract or other legal act governing, among other things, subject matter and duration, type of data, security measures, use of sub-processors, assistance with data subject rights, and deletion or return at the end of the relationship.

The qualification is not automatic and depends on the actual conditions. A business account sits differently from a personal account used for work, where the company has no agreement at all. To check against the contract terms, not the product name:

• whether a data processing agreement exists and what it contains;
• whether users' content can be used to train the vendor's models;
• retention periods for prompts and conversations;
• who the sub-processors are and where they operate.

When is a DPIA needed for generative AI?

The data protection impact assessment (DPIA) under article 35 is mandatory when processing may present a high risk to people's rights and freedoms. There is no rule requiring it for every use of a generative assistant, and none excluding it either.

Factors pointing toward a DPIA:

• large-scale processing of personal data;
• special categories of data or data about vulnerable people, including workers;
• use of new technologies with effects on people, such as recruitment or customer scoring;
• combining different datasets through connectors.

It is best to decide per use case, recording the decision even when a DPIA is not needed. An AI use case register is the basis for doing this in an orderly way. For cases that fall among the high-risk systems of the AI Act, the GDPR assessment sits alongside the deployer obligations.

What does the GDPR say about transfers outside the EU?

Chapter V of the GDPR allows transfers of personal data to third countries only under precise conditions: an adequacy decision, appropriate safeguards such as standard contractual clauses, or other mechanisms provided for. Many generative AI vendors are based or have infrastructure outside the Union, or use sub-processors that do.

Questions to put to the vendor and record:

1. In which region are prompts, files and logs processed and stored?
2. Are EU data residency options available and are they active in your contract?
3. Which transfer mechanisms are used and with which sub-processors?
4. Can the vendor's staff access the content, and when?

The answer affects both the DPIA and the relationship with information security, which for entities subject to NIS2 adds supply chain risk management: see the article on NIS2 and artificial intelligence.

Generative AI checklist for the DPO

1. Inventory the generative AI tools and use cases in use, including unauthorized ones (shadow AI).
2. For each use case, list the categories of personal data involved and the people affected.
3. Assign a legal basis per purpose and document it in the record of processing activities.
4. Check that the notices to customers, suppliers and employees describe the actual use.
5. Review the vendor agreement under article 28: instructions, security, sub-processors, deletion.
6. Verify use of content for training and retention periods.
7. Map processing locations and transfer mechanisms outside the EU.
8. Decide and justify in writing whether a DPIA is needed, and revisit it when the use changes.
9. Define a policy on the data allowed in prompts and train people.
10. Set a periodic review of tools, features and contract terms.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. On the GDPR topic it offers a view by tool and use case of what the DPO needs to know: which assistants are in use, in which departments, with what intensity, and which obligations apply to each. The regulatory mapping helps clarify obligations and gaps, but it is not legal advice. Learn more on the Compliance page.

Sources

• GDPR, Regulation (EU) 2016/679
• AI Act, Regulation (EU) 2024/1689
• NIS2, Directive (EU) 2022/2555