"Are we even allowed to do this?" holds up more AI projects inside companies than any technical obstacle. It is rarely answered and usually deferred — and in the meantime staff use the tools anyway, just without a rule.
This article answers it. Not exhaustively in legal terms, but well enough for a management team to decide: what has to exist in writing, what EU hosting really settles, how long data may be stored, and what has been added since 2 August 2026.
1. The short answer in four sentences
You may put personal data into an AI tool if a data processing agreement under Art. 28 GDPR exists with the provider, if you have a legal basis for the processing, if the data flow is entered in your record of processing activities and in your privacy notice, and if it is clear how long the provider stores the data and whether it trains on your inputs.
If one of those is missing, the problem is not the provider's, it is yours. The controller under the GDPR is the company that puts the data in — not the one that processes it.
2. Why an AI tool is a processor
A processor is anyone who processes personal data on another party's instructions. That is exactly what an AI provider does when you hand it a text containing customer names to summarise: you determine the purpose and means, it carries them out. Art. 28 GDPR therefore applies — and it requires a contract, not an agreement by tick box.
The second point is overlooked more often. Personal data appears faster than most people assume. Not just the obvious customer list, but also:
- a forwarded customer email that you "just want summarised quickly",
- a job application an AI is meant to pre-sort,
- meeting minutes containing names and assessments,
- a CRM screenshot someone drags into a chat window,
- a support ticket used as an example in a prompt.
In all five cases personal data leaves your organisation. Whether that is permitted is decided not by the volume but by whether the framework is in place.
3. What the DPA has to cover
Art. 28(3) GDPR lists what a data processing agreement must regulate. That list is your review grid when a provider puts its standard document in front of you.
The large providers do have such a contract available — but often only on a business or enterprise plan, and frequently it has to be concluded explicitly inside the account. A private account someone works with "just for a moment" has none. That is the most common practical finding inside companies, and it can be fixed in an hour.
4. EU hosting: what it solves, what it leaves open
"We have EU servers" is a good argument — but it answers exactly one question out of four. EU hosting settles the place of processing. It says nothing about whether a processing agreement exists, how long data is stored, or whether your inputs are used for training.
For US providers there is the additional question of third-country transfer. The EU-US Data Privacy Framework remains in force as an adequacy decision; for certified providers the transfer is covered by it. It is under pressure, though: on 29 June 2026 the US Supreme Court held in Trump v. Slaughter that the independence of the Federal Trade Commission is unconstitutional — and the FTC is one of the oversight mechanisms the decision relies on. The Latombe case (T-553/23) is also pending before the General Court of the European Union.
What does that mean in practice? Not: switch immediately. Rather: choose in a way that would keep switching possible. Anyone tying every process firmly to a single US provider today has no second move if it comes to that.
5. Retention and training: the three switches
Three settings determine what happens to your inputs. Each is a separate question to the provider, and each should be answered in writing.
Switch 1: how long inputs are kept
How long does an input stay with the provider? A few days up to 30 days for abuse detection is common. What matters is not the number but that it appears in the contract — a period stated only in a help centre can change without you hearing about it.
Switch 2: training on your data
Are your inputs used to improve the models? On business plans this is usually switched off; on private accounts often not. Check it in the contract documents rather than in the marketing material — and check it again when the provider changes its terms.
Switch 3: logs and human access
Who at the provider can see your inputs, under what circumstances, and for how long? This is the point that most often stays unanswered in audits — and the one that decides the matter for sensitive content.
6. What the regulators say: EDPB Opinion 28/2024
On 18 December 2024 the European Data Protection Board published Opinion 28/2024 on AI models. It is currently the most important shared reference point among European supervisory authorities, and it answers three questions:
- When does an AI model count as anonymous? When identifying the individuals concerned, or extracting personal data from the model, is highly unlikely. The Board names a non-exhaustive list of testing methods for this — so a model is not anonymous simply because it is not a database.
- Can legitimate interest serve as the legal basis? In principle yes, via a three-step test: the processing must be necessary for the interest, the rights of the individuals concerned must be protected by measures, and those individuals must be able to reasonably expect the processing.
- What applies to models trained unlawfully? Using such a model may itself be impermissible — unless proper anonymisation has taken place.
The third point is the uncomfortable one. It shifts part of the responsibility onto deployment. Anyone using a model should therefore at least know what the provider says about its training data.
7. New since 2 August 2026: the transparency duty
Since 2 August 2026 the transparency obligations of the AI Act have applied to deployers as well — that is, to companies that merely use AI rather than develop it. Under Art. 50 that means, in essence:
- People must be able to recognise that they are communicating with a machine.
- Generative outputs have to be marked as AI-generated in machine-readable form. For systems placed on the market before 2 August 2026 there is a transition period for this until 2 December 2026.
- Where emotion recognition or biometric categorisation is used, the individuals concerned have to be informed.
- Deepfakes and published AI texts on matters of public interest have to be labelled.
What does not yet apply: the high-risk obligations have been postponed — to 2 December 2027 for the Annex III use cases and to 2 August 2028 for Annex I. The new prohibitions under Art. 5 take effect from 2 December 2026.
For marketing and communications, labelling is the part that matters most. What that looks like in concrete terms is set out in our article on Article 50 and labelling AI content in marketing.
8. Four steps to a defensible sign-off
Step 1: take stock of what is actually running
Do not ask which tools are approved, ask which are used. The answer is almost always longer. Note for each tool: who, for what, with which data, on which plan. Half a page is enough.
Step 2: collect the contracts
For every tool that touches personal data: conclude a processing agreement or switch the tool off. There is no third outcome. Check the contract against the Art. 28(3) list — not in order to negotiate it, but so that you know what you have signed.
Step 3: write it down
Record of processing activities under Art. 30, privacy notice under Art. 13/14, and where relevant an impact assessment under Art. 35. This step feels like bureaucracy and is the only one that counts in an audit: what is not documented did not happen.
Step 4: a policy that can be read in five minutes
Not a twenty-page data protection concept, but one page: which tools are approved, which data may go in, which never may, and who to ask in case of doubt. Add a short briefing — the AI Act expects deployers to promote AI literacy among their staff in any case. We run this as a compact workshop, but it works just as well in house.
9. The five most common mistakes
- A private account used at work. No processing agreement, no training opt-out, no control. The most frequent finding of all.
- Mistaking EU hosting for approval. The location is settled, the rest is not.
- A privacy notice that says "we use AI". Too vague to satisfy the duty to inform.
- Nobody knows the retention period. Not even the person who introduced the tool.
- Everything with one provider. Legally defensible, strategically risky — see the section on EU hosting above.
10. Conclusion: writing it down beats gut feeling
The question "are we allowed to?" has an unspectacular answer: you are, if you write it down. A processing agreement, an entry in the record, a paragraph in the privacy notice, one page of policy — that is the entire difference between a tolerated state of affairs and a defensible one.
For most companies the effort involved comes to less than a day. What makes it expensive is postponement: the longer the tools run without a framework, the more data has already flowed, and the more uncomfortable the stocktake becomes.
If you want to sort out the data side more fundamentally, first-party data as the foundation sets out the wider frame; the underlying trade-off between ethics, law and effect is covered in ethics, law and psychology in AI marketing.
Our assessment: the framework is cheaper than almost anyone expects and is postponed by almost everyone. We run exactly this stocktake with management teams on a regular basis — soberly, in two hours, with a list at the end. That list, not the tool choice, is what decides whether AI use survives the first serious question.
11. FAQ: common questions about AI tools and the GDPR
Do I need a data processing agreement for ChatGPT?
Yes, as soon as personal data goes in — and that happens faster than many assume: a job application, a customer email, minutes containing names. The provider processes that data on your instructions, which is processing under Art. 28 GDPR. Without a contract the basis is missing, and it is missing on your side, not the provider's: you are the controller. The large providers make a DPA available, usually on a business or enterprise plan and often only after it is actively concluded in the account.
Is a plan with EU servers enough to settle everything?
No. EU hosting answers one question — where the data sits — and leaves three open: whether a processing agreement has been concluded, how long data is stored, and whether your inputs are used for training. A provider can host in Frankfurt and still log for 30 days and train on your data. EU hosting is a component, not an approval.
What happens if an employee enters customer data by mistake?
First of all, this is a question of preparation rather than blame. Check whether deletion is possible (many providers allow individual conversations to be deleted), document the incident, and assess whether a notification duty under Art. 33 GDPR applies. More important is the step before: a short, binding policy saying which data may go into which tool — and which never may.
Do I have to carry out a data protection impact assessment?
Not for every use. It becomes mandatory where the processing is likely to result in a high risk to the rights of the individuals concerned (Art. 35 GDPR) — for instance with large-scale processing of special categories, with scoring and profiling, or with systematic monitoring. An AI tool used for drafting text without any personal data needs none; an AI-assisted applicant pre-selection system very much does.
What has additionally applied since 2 August 2026?
Since that day the transparency obligations of the AI Act apply to deployers (Art. 50): people must be able to recognise that they are speaking with a machine; AI-generated content has to be marked in machine-readable form; where emotion recognition and biometric categorisation are used, the individuals concerned have to be informed; deepfakes and published AI texts on matters of public interest have to be labelled. For systems placed on the market before 2 August 2026, the marking of generative content has a transition period until 2 December 2026.
Does that mean the AI Act's high-risk obligations are active too?
No, those were postponed: to 2 December 2027 for the Annex III use cases and to 2 August 2028 for Annex I. The new prohibitions under Art. 5 take effect from 2 December 2026. Anyone planning today should still know the timetable — the lead time for a high-risk system is longer than the distance to 2027.
Are we still allowed to use US providers at all?
Yes. The EU-US Data Privacy Framework remains in force as an adequacy decision; for certified providers the transfer is covered by it. It is under observation, though: on 29 June 2026 the US Supreme Court held in Trump v. Slaughter that the independence of the FTC is unconstitutional — and the FTC is one of the oversight pillars the decision rests on. The Latombe case (T-553/23) is also pending before the General Court of the EU. Anyone choosing a provider today should therefore know whether they could switch if it came to it.
How long may an AI provider store our inputs?
For as long as your contract with them allows — which is why the retention period is a contractual matter and not a technical footnote. Retention times of a few days up to 30 days for abuse detection are common; some providers also offer business customers processing without storage. What matters is that the period appears in the processing agreement or the terms of use, and that you know it before the first data flows.
What does our privacy notice have to say?
If you use AI tools that process personal data belonging to your customers or applicants, that belongs in the information required under Art. 13/14 GDPR: purposes, legal basis, recipients (that is, the provider), third-country transfer and storage period. A sentence such as "we use AI" is not enough — the details have to be specific enough for an affected individual to follow where their data goes.
