GDPR-compliant AI: the ChatGPT alternative for businesses

Why the GDPR and AI so often collide

Generative AI is as easy for employees to use as a search engine. That is precisely where the data protection risk lies: anyone who copies a customer letter, a job application or a complaint into a private chat account transfers personal data to a provider with which the company has no contract. Whether the inputs are stored, analysed or used for training is then barely controllable.

The solution is rarely a ban. Bans push usage into private channels, so-called shadow AI. More effective is an approved tool that meets the requirements of the General Data Protection Regulation (GDPR) technically and contractually – a GDPR-compliant AI that employees are happy to use.

For decision makers, this means that choosing the tool is the first step, but not the only one. Equally important are the configuration – which models, which data sources, which permissions – and the rules employees work by. This guide covers all three levels.

The legal bases at a glance

For the use of AI in companies, these GDPR provisions are particularly relevant:

• Art. 5 – Principles: Purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
• Art. 6 – Legal basis: Every processing of personal data needs a legal basis, in a business context often performance of a contract or legitimate interest. For employee data, specific employment law considerations apply in addition.
• Art. 13 and 14 – Information obligations: Data subjects must be informed that and how their data is processed.
• Art. 22 – Automated decisions: Decisions with legal or similarly significant effects may in principle not be based solely on automated processing.
• Art. 28 – Processing on behalf of the controller: If an AI provider processes data on behalf of the company, a data processing agreement (DPA) is mandatory.
• Art. 30 – Records of processing activities: The use of AI belongs in the records of processing activities.
• Art. 32 – Security: Appropriate technical and organisational measures, such as access control and encryption.
• Art. 35 – Data protection impact assessment: Where a high risk is likely, for example with extensive processing of sensitive data, a DPIA is required.
• Art. 44 et seq. – Third-country transfers: Transfers outside the EU require an adequacy decision or appropriate safeguards.

In 2024, the German Data Protection Conference (DSK) published guidance on AI and data protection that specifies these requirements for controllers. It is a good starting point for the internal assessment.

The seven checkpoints for GDPR-compliant AI

1. Contract and roles

Clarify whether the provider acts as a processor and conclude a data processing agreement (DPA, Art. 28 GDPR). The contract must govern the obligation to follow instructions, confidentiality, technical and organisational measures, the handling of sub-processors, support obligations and deletion after the end of the contract. Also check the list of sub-processors: which model providers, hosting services and additional services are involved?

2. Storage location and third-country transfers

Where is data stored and where are model requests processed? For the USA, an adequacy decision by the European Commission has existed since 10 July 2023 for companies certified under the EU-US Data Privacy Framework. Otherwise, standard contractual clauses and a transfer impact assessment are required. Many companies prefer providers that store data in the EU and use models in EU regions – this simplifies the assessment but does not replace it.

3. No use for training

Inputs and documents should not be used to train models. Training is a separate processing purpose that would require its own legal basis and can permanently feed data into a model. Make sure this is contractually excluded – including for the model providers in the chain.

4. Access rights that also apply in the AI

An AI with access to file storage, emails or CRM may only show content to those who would be allowed to see it without AI. This requires role-based access control that takes effect when searching the knowledge – not just in the user interface. Otherwise a harmless question can bring confidential salary or HR data to light.

5. Data minimisation and deletion

Connect only the sources that are necessary for the purpose. Define how long chats, uploaded files and transcripts are stored, and ensure that deleted documents no longer appear in answers.

6. Transparency and data subject rights

Inform employees, customers and applicants about the use of AI in your privacy notices. Access, rectification and erasure must also be possible for data held in AI chats, knowledge bases or transcripts. A central tool makes this considerably easier, because the data is in one place.

7. Internal rules and training

An AI policy defines which tools are approved, which data may be entered and when results must be checked. In addition, Art. 4 of the EU AI Act requires measures to ensure employees' AI literacy. Both can be covered well in a joint training session. If there is a works council (Betriebsrat), it must be involved in the rollout, because AI systems are regularly capable of monitoring employees' behaviour or performance.

ChatGPT alternative for businesses: what matters

Many companies are looking for a "ChatGPT alternative" – usually meaning a tool that offers the familiar user experience but is under company control. These criteria distinguish a business solution from a private chat subscription:

• Central administration: The company, not the individual employee, manages accounts, roles and permissions.
• Contractual safeguards: A DPA, technical and organisational measures and disclosed sub-processors are in place.
• Model choice: Several models and providers are available; the organisation decides which are approved. Optionally, your own keys (BYOK) can be stored.
• Company knowledge with sources: The AI answers questions from approved documents and names the sources – more on this in the guide AI knowledge base.
• Cost control: Usage can be analysed and limited by person or cost centre.
• Integrations: Email, calendar, file storage and line-of-business systems are connected so that data does not have to be copied.

The article Using ChatGPT in the company in compliance with the GDPR offers a detailed rollout guide. You will find a provider comparison under Comparison.

Special cases: meetings, HR and sensitive data

Some fields of application deserve special care:

• Meeting recordings and transcripts: The privately spoken word is protected under criminal law (Section 201 of the German Criminal Code, StGB). Participants must be informed and give their consent before recording. The article GDPR-compliant meeting transcription explains the details.
• HR processes: AI for candidate selection or performance evaluation concerns employee data and Art. 22 GDPR, and is classed as a high-risk application under the EU AI Act.
• Health and other special categories of data (Art. 9 GDPR): Stricter legal bases are required here, often also a data protection impact assessment.
• Professional secrecy: Professionals bound by secrecy, such as tax advisers or doctors, must additionally observe Section 203 of the German Criminal Code (StGB) and bind service providers accordingly.

Cloud, EU hosting or on-premises?

People often ask whether AI can only be compliant with data protection law on their own servers. The GDPR does not require a particular operating model, but appropriate protection. An on-premises AI gives maximum control but requires your own hardware, operations, updates and security expertise – and powerful models are only available locally to a limited extent. A cloud service with hosting in the EU, a DPA, EU model regions and a sound permissions concept is the pragmatic route for most mid-sized companies.

Rollout checklist

1. Define use cases and data categories
2. Assess providers: DPA, technical and organisational measures, sub-processors, storage locations, training excluded
3. Document the legal basis and update the records of processing activities
4. Check whether a data protection impact assessment is required
5. Configure roles and permissions, connect sources selectively
6. Update privacy notices
7. Involve the works council, publish an AI policy, carry out training
8. Review regularly: new features, new providers, new data sources

Who is responsible for what in the company

Data-protection-compliant AI is teamwork. A clear division of roles has proven effective:

• Management: bears responsibility as the controller within the meaning of the GDPR, approves tools and policy, and provides resources for rollout and training.
• Data protection officer: advises on the legal basis, DPA, data protection impact assessment and information obligations, and monitors compliance.
• IT: reviews technical and organisational measures, sets up sign-in, roles and integrations, and monitors access.
• Departments: define use cases, decide which sources are needed and check results for subject-matter accuracy.
• Works council (Betriebsrat): is involved in the rollout; a works agreement creates clarity for all sides.
• Employees: follow the policy, enter only permitted data and report anything unusual.

Typical mistakes and how to avoid them

• Only banning: A ban without an alternative leads to private use on personal devices. Offer an approved tool.
• Treating the DPA as a formality: Read the list of sub-processors. What matters is which model providers and additional services actually receive data.
• Connecting all sources at once: The more data is included, the greater the risk of unintended disclosure. Start with well-maintained repositories with clear permissions.
• Checking permissions only in the user interface: If the knowledge search ignores permissions, no menu control will help. Test specifically with accounts holding different roles.
• Forgetting retention periods: Chats and transcripts accumulate quickly. Define deletion rules and check whether they are technically implemented.
• Extending features unchecked: New features such as voice recording, web search or image generation can bring in new service providers. Review every extension again.
• Postponing documentation: Records of processing activities, the justification of the legal basis and training records are your most important evidence if things go wrong.

How AIPE supports data-protection-compliant use of AI

AIPE is primarily hosted in Germany. The data processing agreement, including technical and organisational measures and the list of sub-processors, can be viewed online. For the published model providers, AIPE uses EU regions; which models an organisation permits is configurable, and your own provider keys can be stored. Every resource – files, chats, agents, wiki, skills – belongs to an organisation and follows roles, groups and sharing; the knowledge search only considers documents that the person asking is allowed to read. Usage can be analysed by person and cost centre and limited with budgets. Assessing your specific processing remains the task of your data protection team – we support it with documentation and answers. More about the platform under AIPE platform.