Using ChatGPT in Your Company in Line with the GDPR

This article is not legal advice.

In many companies ChatGPT has long been in use – just not officially. Employees draft emails, summarise contracts or have Excel formulas explained, often with a private account. That is understandable, because the tools are useful. For management, however, it creates a risk they do not control. This article shows which questions you need to settle so that the use of AI chats is compatible with the GDPR, and how to turn that into a sustainable solution.

The real problem: shadow AI

Shadow AI refers to AI services used in everyday work without approval and without a contractual basis. The typical example is a private ChatGPT account into which customer data, quotes or internal documents are pasted. This causes several problems at once:

• No contract: There is no agreement between your company and the provider. The provider processes the data under its consumer terms.
• No control: You do not know which data has left the company, and you cannot lock the accounts of departing employees.
• Training on inputs: With consumer plans, inputs may be used to improve the models depending on the settings. In its help article on data usage, OpenAI states that this is enabled by default for personal accounts and can be switched off, while Business, Enterprise and API data is not used for training by default.
• No traceability: Without a central solution there are no roles, no logs and no basis for handling access or erasure requests.

A blanket ban rarely solves this. The need remains; usage simply moves further into the shadows. An approved tool with clear rules is more effective.

Which legal basis do you need?

As soon as personal data enters an AI chat – names, email addresses, meeting notes, application documents – the GDPR applies. Every processing operation requires a legal basis under Art. 6(1) GDPR. In day-to-day business, performance of a contract (point b) and legitimate interest (point f) are the most relevant, for example when a sales employee answers a customer enquiry with AI support. With legitimate interest, you must balance it against the interests of the data subjects and document that assessment.

Special categories under Art. 9 GDPR, such as health data, as well as employee data are particularly sensitive. Here you should strictly limit or exclude use. In its guidance on artificial intelligence and data protection, the German Data Protection Conference (DSK) sets out what controllers should consider when selecting and using AI applications.

Data processing agreement under Art. 28 GDPR

If you use an external AI service that processes personal data on your behalf, you need a data processing agreement (DPA) under Art. 28 GDPR. Among other things, it stipulates that the provider only processes on your instructions, which technical and organisational measures (TOMs) apply and which sub-processors are involved.

A consumer account does not provide this basis. When choosing a provider, make sure the DPA can be concluded before use, that the list of sub-processors is available and that you are notified of changes. Also check who actually operates the models in multi-layered solutions: a platform can itself be hosted in Germany and still forward requests to a model provider.

Third-country transfers: what applies to US providers?

If data is transferred to the US, the rules of Art. 44 et seq. GDPR apply. On 10 July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework. Transfers to US companies certified under this framework are therefore permitted without additional standard contractual clauses. You can check whether a provider is certified in the official participant list.

The framework has withstood a challenge before the EU General Court, but remains politically and legally contested. Many companies therefore prefer models operated in EU data centres. This reduces dependence on a single legal basis and simplifies documentation. Read more in our guide to GDPR and AI.

Access rights: who may see what?

Data protection does not end with the provider contract. As soon as AI chats access company knowledge – manuals, contracts, project folders – the question arises who may retrieve which content via the AI. A tool that makes all documents accessible to every employee quickly violates the need-to-know principle. Look for role-based access control (RBAC) at the level of individual resources, and make sure the AI only uses content the person asking would be allowed to open themselves.

Policy and AI literacy under Art. 4 AI Act

Since 2 February 2025, Art. 4 of the AI Regulation (AI Act) requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. For companies using AI chats, this means in practice: train your employees and put the rules in writing. Our EU AI Act guide gives an overview of the obligations.

An AI policy does not need to be long. At a minimum it should define:

• which AI tools are approved and which are not,
• which types of data may be entered and which are excluded,
• that results are reviewed before use, because models can hallucinate,
• who the contact person is for questions and incidents,
• how new use cases are approved.

If you have a works council, involve it early. Tools that log usage data may be subject to co-determination.

Checklist for GDPR-compliant use

1. Inventory: Find out which AI services are already in use today and for what.
2. Choose a tool: Opt for a business plan or a platform with a DPA, a visible sub-processor list and clear statements on training.
3. Document data flows: Record where the platform is hosted, which model providers are involved and in which regions they process data.
4. Legal basis and records of processing: Update your records under Art. 30 GDPR and check whether a data protection impact assessment under Art. 35 GDPR is required.
5. Configure access rights: Define roles and permissions before connecting company knowledge.
6. Policy and training: Publish rules and document AI literacy training.
7. Replace private accounts: Communicate the approved alternative and ask staff not to use private accounts for business data.
8. Review regularly: Monitor changes to sub-processors and model providers.

How AIPE addresses these requirements

AIPE is a hosted AI platform for mid-sized companies that takes many of these points into account from the outset. The platform is primarily operated at Hetzner in Germany. You can view the data processing agreement online, including TOMs and the list of sub-processors.

Model providers can be configured per organisation. EU regions are available for the published providers, such as Azure OpenAI in Sweden Central, Amazon Bedrock in Frankfurt, Google Vertex AI in europe-west1 and Mistral in the EU. With BYOK you can store your own provider keys if you wish and keep your existing contracts.

Roles, groups and sharing apply per organisation and per resource – for files, chats, agents and the wiki. Answers from company knowledge include source references, so employees can verify results. This gives your teams an approved alternative to private accounts. You will find an overview of the features on the platform page. If you would like to discuss your specific case, book an appointment.