Which AI Tools Are GDPR Compliant? Your Side of the Deal
Last Updated: October 2026
A GDPR compliant AI is a deal in two halves, not a product you can buy off a shelf. The vendor covers how its own service handles data. You cover what you put in, why you may use it, who you told, and how long it stays. Both halves have to hold. A badge on a sales page answers the first half and leaves the second one sitting on your desk.
AI Smart Ventures has guided founder-led teams through AI adoption for more than a decade, and this is where the question lands wrong. Owners ask which tool is safe to sign. The harder question is what their own file would show if a client asked what went into that tool last Tuesday.
Your own data protection adviser or counsel decides what applies to you, and a US business can be in scope where it handles data about people in the EU or the UK. Skip the paperwork, and you carry the whole deal alone. The vendor can show its terms in a minute; you could show nothing.
Key Takeaways
- The deal splits in two: the vendor answers for its own service, and you answer for what you feed it.
- You are the controller: the EU’s data protection board puts the duty on whoever decides why and how data gets used. That is you, not the tool.
- Running it does not move the duty: the UK regulator’s report on agentic AI of 8 January 2026 leaves it with the business.
- Your record is six short fields: purpose, data groups, who sees it, transfers out of the EEA, how long you keep it, and a note on security.
- One month is the clock: you answer a request to erase data “without undue delay and at the latest within one month”.
- Plain words are part of it: France’s data regulator, the CNIL, said on 5 January 2026 that people must grasp how their data gets used.
Read as a set, those six describe a filing job rather than a shopping job. None of them needs the vendor’s blessing, and none can be bought from them.
Can any AI tool be GDPR compliant on its own?
No tool can be, because the rules land on two parties at once. The vendor answers for its own service: security, staff, sub-contractors. You answer for the personal data you put in, which the EDPB calls “any information relating to an identified or identifiable individual”. A badge on a sales page is real proof about their half. It proves nothing about yours. Nobody else writes that part.
The split has names in the law. A controller “determines the purposes and means of processing personal data”, while a processor “acts under the instructions of the controller only”. Buy a tool and you are nearly always the controller, because you chose the job it does. The UK regulator put it plainly on 8 January 2026: “AI agency does not mean the removal of human, and therefore organisational, responsibility for data processing.” Vendor-side checks sit elsewhere on this site.
What personal data actually goes into the tool?
More than most teams expect, and nobody wrote it down. Prompts carry names. So do pasted emails, uploaded contracts, exported sheets, applicant files and the half-finished proposal someone dropped in for a tidy-up. Your side of the deal starts with a list: one line per use, naming the data group and the reason you may use it. The EDPB guide says you need a legal basis before you use personal data.
That reason has a name: a lawful basis, the ground the law accepts for using someone’s data. Six exist, and consent is only one. The others are keeping to a contract, meeting a legal duty, a public task, vital interests, and your own legitimate interests. Pick one per use, before the use starts, and write a line saying why it fits. Some work never needs the upload at all, which is its own question.
| What goes in | Where it came from | The reason you point to |
|---|---|---|
| Names in a pasted email | Your inbox | Keeping to the client contract |
| A sales export to summarize | Your CRM | Your own legitimate interests |
| An applicant’s resume | A hiring form | Steps taken before a contract |
| A supplier list | A shared drive | Your own legitimate interests |
Do you have to tell people an AI tool is involved?
Yes, where their personal data goes into it. Being open is one of the principles, so the people whose data you hold can find out what you do with it. The EDPB says the wording has to be “concise”, “easily accessible” and in “clear and plain language”. That rules out legal boilerplate nobody reads, and it rules out saying nothing, which is the usual choice.
In practice this is one short passage in your privacy notice and your client terms. Name the kind of tool, the purpose, the basis you picked, who else sees the output, and the region the data sits in. The CNIL set the test on 5 January 2026: “The complexity of AI systems should not prevent individuals from understanding how their data is used.” Treat the passage as change management, not as legal cover.
What should your record of the processing show?
Six fields, and they fit on one page. The EDPB lists the purpose, the data groups, who has access, and any transfer outside the EEA. Add how long you keep it, where that is possible, and a general note on your security. Records “should be kept in writing, including in electronic form”. Keep it current. The record has to be open to your regulator if it asks.
A common hope is that a lean headcount removes the duty. The gap is narrower than that: a business under 250 staff may leave out “purely occasional activities”, and a weekly client workflow is not one. Add one field the law does not list, because you will want it. That is the written contract with the vendor, called a data processing agreement, which sets out what they may do with your data. It is required, so log its date.
- Name the tool and plan: one line each, with the date you last checked it and who checked.
- Say what the job is: the purpose in one sentence, in the words you would use with the client.
- List the data groups: client contacts, staff records, applicant files, whatever really goes in.
- Log the agreement: when the data processing agreement was signed, and where the signed copy now lives.
- Give it a clock: how long the tool holds the data, plus the date this page gets read again.
Writing the first record is quick. Keeping it true as tools change is the part that slips. AI Smart Ventures offers AI Advisory that builds the record as the rollout happens, so your AI strategy and your paperwork stay one page.
Where does the data sit, and how long is it kept?
Two answers belong in writing: the region, and the clock. On region, the EDPB says personal data may leave the EEA only on the terms set out in Chapter V of the law. On the clock, storage “must be limited in time, in light of the purpose for which this data was collected and processed”. Neither answer is the vendor’s to hand you, though they hold half the facts.
Three questions firm up the picture fast. Where does the service handle the data, where do the logs and backups live, and where do the support staff sit who can open your account? Then set a limit for each purpose and a plain step for deleting what is past it. Write the answers next to the tool name. What you may still keep from closed client work is a separate question with its own answer.
Could you delete one person’s data if asked today?
You should be able to, and the clock is short. The EDPB says you answer a request to erase data “without undue delay and at the latest within one month after receipt of the request”, with two more months if it is truly complex. The hard part is not the reply. It is finding every copy: the chat history, the uploaded file, the exported sheet and the backup nobody mapped.
Run it once as a drill, with a real name and a stopwatch. Most teams find two or three places they had forgotten, and that is a finding worth having before a client asks rather than after. The CNIL notes that rights reach “both the training dataset and the AI model itself, if the model is not considered anonymous”. Generic AI consultants rarely test this step. Run the drill early, and treat it as capability building.
Frequently Asked Questions
What does GDPR stand for, and who does it cover?
GDPR stands for the General Data Protection Regulation, the EU’s data law. It has applied since May 2018. Being compliant means showing a lawful reason for each use of personal data, who you told, and the record you kept. The European Commission says it reaches a firm based outside the EU that sells goods or services to people in the EU.
Can one AI chatbot be called GDPR compliant?
Not on its own, and no careful vendor claims it. A service can offer terms, settings and a data location that suit you, while your use still falls short because nobody wrote down the purpose, the basis or the notice. The claim that can be tested is always about one named use inside one business, never about a brand. Ask what your own file would show.
Does a US company have to follow GDPR?
It can, and plenty do without knowing it. The European Commission gives the example of a firm set up outside the EU that aims its services at people in the EU. One whose customers all sit outside the EU is treated another way, even if its site is reachable from Europe. The line turns on facts, so your counsel decides.
What is a lawful basis, in plain words?
It is the reason the law accepts for using someone’s personal data. You pick it before you start, and you write it down. Six exist: consent, keeping to a contract, meeting a legal duty, a public task, vital interests, and legitimate interests. You rely on one each time. Picking one forces a useful question about any new tool, which is what this data is really for.
What does a data processing agreement do for you?
It is the written contract between you and a supplier who handles personal data for you, and the law requires it. They act only on your instructions. They keep the data private, secure it, and bring in no sub-contractor without your written say-so. They help you answer requests, then delete or return the data when the service ends. Keep the signed copy and its date.
Do you need consent to put client data into AI?
Often not. Consent is one of six lawful bases, and it is often the weakest fit for routine business records. It has to be freely given, and it can be taken back. Keeping to your contract with the client, or your own legitimate interests after a balancing exercise, may suit the work better. The choice changes the notice you write, so confirm it with your adviser.
Who should own this paperwork on a lean team?
One named person, and ideally not whoever chose the tool. An ops lead works well, because the record is mostly a list of workflows, not a legal document. Give them the right to add a tool to the list, a calendar date to read the page again, and five minutes on the management agenda. Rules with no owner go stale within a quarter.
How do you start if you kept no records at all?
Start with one tool and one workflow, not the whole stack. Write the purpose, the data groups, the reason you may use it and the region it sits in. Then have your adviser read that single page back to you. Scope drives the effort, and it shrinks when you start with the busiest use instead of an audit of everything. Schedule a consultation to work through the first one.
Executive Summary
A GDPR compliant AI is a deal in two halves, and only one half is for sale. The vendor covers its own service. You cover the personal data you put in, the reason you may use it, the people you told, the record you keep, the region it sits in, and how long it stays. You also cover whether you could delete one person’s file inside a month. Start with one tool, write one honest line per use, and have your adviser read it. This is practical AI housekeeping.
What Should You Do Next?
Take the AI tool your team uses most and write one page about it this week. Put down what personal data goes in, why you may use it, who you told, where it sits, and how long it stays. Add who signed the agreement with the vendor. Then read that page aloud to your adviser or counsel.
AI Smart Ventures offers AI Advisory for growing businesses that want AI adoption written down as it is built. Ask for the clarity and confidence to answer a client question later. Schedule a consultation to turn a tool list into a record you can hand over.
People Also Read
- AI Founder-Led Agency Studios Under 15: A Realistic Stack
- SCORE SBDC AI Curriculum Owner-Operators: What Mentors Teach
About the Author
Nicole A. Donnelly is the Founder of AI Smart Ventures and an AI Adoption Specialist with 20 years of experience as a founder and CEO and over a decade leading AI adoption initiatives. She helps businesses integrate artificial intelligence with clarity and confidence, driving innovation and sustainable growth. Nicole has trained over 20,217 professionals in Applied AI, delivered 624 workshops, and worked with close to 1,000 organizations across diverse industries.
Expertise: AI Transformation, AI Strategy, AI Implementation, AI Adoption, Applied AI, Marketing, Business Operations
Disclaimer: This content is for informational purposes only and does not constitute professional business or technology advice. Results vary based on industry, existing systems and implementation commitment. Contact AI Smart Ventures for a consultation regarding your specific situation.
