GDPR and AI

The GDPR has no dedicated AI article – its principles apply to AI systems just as they do to any other data processing. Anyone who has personal data processed by a language model needs a legal basis (Art. 6 GDPR), must define the purpose, and may only hand over the data required for it. When a company uses an AI provider, that provider typically becomes a processor – and Art. 28 GDPR then requires a data processing agreement. Added to this are technical and organisational measures under Art. 32 GDPR, such as encryption and access control.

In day-to-day business, data protection in AI use comes down to concrete questions: Where are inputs processed – in the EU or in a third country? Are they stored after the response, or used to train models? And who in the company is allowed to hand over which content to an AI in the first place? Especially in SMBs, risk often arises casually, when employees copy customer data into freely available chatbots covered by no contract and no oversight. A short internal AI policy and vetted tools prevent that.

Chifty implements these requirements as concrete measures instead of claiming a blanket seal: content is stored on servers in Germany, AI processing defaults to the EU (Google Cloud Vertex AI, region europe-west1), and transmission is encrypted with TLS throughout. With Google Cloud Vertex AI and OpenAI, we have contractually agreed that requests are not retained after processing; your content is not used to train the models we use. A DPA under Art. 28 GDPR is available on request.

On top of this comes the permission principle: the AI must not bypass permissions. Answers draw only on sources approved for the asking person, and show citations – data minimisation not as a statement of intent, but as a technical filter at query time. The GDPR should also be distinguished from the EU AI Act: Regulation (EU) 2024/1689 governs AI systems themselves, while the GDPR governs the handling of personal data. Both apply side by side.