AI + personal data = non-negotiable GDPR
An SMB launches an AI-based customer scoring project. It sends 50,000 customer records — names, emails, purchase histories, browsing behaviors — to a cloud model without GDPR checks. Three months later, a customer exercises their right of access. The company can't explain how their data was processed, nor prove that it wasn't used to train the model. Risk: a CNIL fine and loss of customer trust. The 15-point GDPR/AI checklist covers the 4 pillars: lawful collection, minimization, retention period and individuals' rights.
The problem
Generative AI has created a sense of urgency in companies: "we have to deploy fast, we'll handle compliance later". The result: personal data circulates in AI tools without a legal framework, without documentation and without informing the individuals concerned.
The most common mistakes in SMBs and mid-market companies:
- Data sent to an LLM without a DPA — Employees use the free version of ChatGPT to analyze contracts containing customer names and addresses. The data passes through OpenAI's servers without a processing agreement, and may be used to train the model. Violation of the principle of lawfulness and security.
- Excessive collection "just in case" — A churn prediction project collects 85 columns of customer data when 12 would be enough. The unnecessary columns include sensitive data (family situation, opinions expressed in support tickets). Violation of the minimization principle.
- No retention period defined — The AI model's training data is kept indefinitely "to be able to retrain if necessary". No purge is planned. Data from customers who left the company 5 years ago is still in the training set. Violation of the storage limitation principle.
- Individuals' rights ignored — A customer requests the deletion of their data. The team deletes the CRM record but forgets that the data is also in the AI model's training set, in the embeddings of the vector database and in the inference logs. The deletion is incomplete.
To frame your AI projects in compliance with the GDPR, see our generative AI governance and risks page.
The AI solution
GDPR compliance isn't a brake on AI — it's a framework that structures your projects. Here are the three levers to integrate the GDPR from the design stage of your AI projects (privacy by design).
Automated pre-deployment checklist
Before each go-live of an AI model, an automated form checks 15 points: documented legal basis, DPIA completed if necessary, minimized data, defined retention period, DPA signed with the cloud provider, individuals' information up to date. Deployment is blocked until the checklist is validated.
AI-based anonymization and pseudonymization
A pre-processing pipeline automatically detects personal data (NER: names, addresses, emails, phone numbers, IBANs) and anonymizes or pseudonymizes it before sending to the AI model. Techniques include masking, generalization (exact age → age range) and differential privacy. The AI model works on protected data without significant performance loss.
Augmented register of AI processing
The GDPR register is enriched for each AI processing operation: model used, input data, purpose, legal basis, retention period of the training data and inference logs, processors involved. AI assists the drafting by pre-filling the fields from the technical metadata of the pipeline.
Implementation
Bringing your AI projects into GDPR compliance happens in three phases over 4 to 8 weeks.
Audit of the existing setup (weeks 1-2)
Inventory all AI projects in progress and in production. For each, identify: which personal data is processed, on what legal basis, with which provider, and whether a DPIA is necessary. Check that each cloud AI provider has signed a compliant DPA. List the gaps and prioritize by risk level.
Remediation and tooling (weeks 3-6)
Fix the identified gaps: sign the missing DPAs, write the necessary DPIAs, set up automatic anonymization on at-risk pipelines. Deploy the pre-deployment checklist in your go-live process. Define the retention periods for each type of data (training, inference, logs).
Training and ongoing process (weeks 7-8)
Train the data and business teams on GDPR principles applied to AI. Integrate the checklist into the workflow of every new AI project. Plan a quarterly audit to verify ongoing compliance. Document the procedures for responding to rights requests (access, deletion, portability) including AI data.
Results
Here are the benefits observed at our clients after setting up the GDPR/AI framework.
Frequently asked questions
Does the GDPR prohibit using AI on personal data?
No. The GDPR doesn't prohibit the use of AI on personal data — it regulates it. You can process personal data with AI provided you respect the fundamental principles: legal basis (consent, legitimate interest, contract), minimization (collect only what's necessary), transparency (inform individuals), retention limits and security. The key is to document and justify each processing operation.
Do you need a DPIA (data protection impact assessment) for every AI project?
Not systematically, but it's mandatory in three cases: large-scale processing of sensitive data, profiling with legal effects, and systematic monitoring. In practice, the CNIL recommends a DPIA for any AI project that processes personal data automatically. It's also good governance practice that reassures your clients and partners.
Can you send personal data to a cloud LLM (GPT, Claude)?
It's possible but under strict conditions. Check that the provider offers a GDPR-compliant DPA (Data Processing Agreement), that the data is not used to train the model, and that the servers are in Europe or covered by standard contractual clauses. Favor enterprise APIs (not consumer versions) and anonymize the data before sending when possible.
What penalties apply in case of GDPR non-compliance on an AI project?
Penalties range from a warning to a fine of up to 20 million euros or 4% of annual worldwide revenue. In France, the CNIL has issued fines of 10,000 to 150,000 euros for SMBs. Beyond the fine, the risk is also reputational: a public formal notice from the CNIL can have a significant commercial impact.
For tech profiles
Technical implementation of GDPR/AI compliance
Presidio / spaCy NER
Microsoft Presidio automatically detects and anonymizes PII (Personally Identifiable Information) in text: names, addresses, emails, phone numbers, IBANs. Combined with spaCy fr_core_news_lg for French NER. 92%+ accuracy on French-language data. Integrates into a Python pipeline in 20 lines of code.
OpenDP / Google DP Library
For training datasets, differential privacy adds mathematically calibrated noise that prevents re-identification while preserving the statistical properties. OpenDP (Harvard) and Google DP Library are open source. Ideal for scoring and customer segmentation models.
Recommended tools
Comparison of anonymization approaches
| Criterion | AI anonymization (NER) | Pseudonymization | Synthetic data |
|---|---|---|---|
| GDPR protection | Strong (out of GDPR scope) | Partial (still personal data) | Strong (no real data) |
| Data usefulness | Reduced (loss of context) | Preserved | Variable depending on quality |
| Complexity | Medium (NER + rules) | Simple (mapping table) | High (GAN / generative model) |
| Reversibility | Irreversible | Reversible (with key) | Not applicable |