Skip to content
SimpleAct Logo

Data protection · AI Act

As of October 2026 – AI Act as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)

GDPR and AI at work: using ChatGPT, Copilot and similar tools lawfully

As soon as staff enter personal data into an AI tool or the AI prepares decisions about people, the GDPR applies. The AI Act comes on top but does not replace it. This page explains which obligations follow from both and what to check before rollout.

GDPR and AI Act: how they fitCheck your AI tool

Short answer

You can use generative AI such as ChatGPT or Copilot at work in line with the GDPR if you have a legal basis for every processing of personal data (Art. 6(1) GDPR), sign a data processing agreement with the vendor where it processes on your behalf (Art. 28(3) GDPR), safeguard transfers to third countries (Art. 44 et seq. GDPR), inform data subjects (Art. 13 and 14 GDPR) and carry out a data protection impact assessment beforehand where a high risk is likely (Art. 35 GDPR). The AI Act applies alongside: since 2 February 2025 deployers must take measures for their staff's AI literacy (Art. 4), and since 2 August 2026 certain disclosures are required (Art. 50(4)). The GDPR remains unaffected (Art. 2(7) AI Act).

Basics

GDPR and AI Act apply side by side

The two regulations govern different things. The GDPR is triggered by the processing of personal data, whatever the technology (Art. 2(1) GDPR). The AI Act is triggered by the AI system and applies to deployers established in the Union even where no personal data is involved (Art. 2(1)(b) AI Act).

Where an AI system processes personal data, both apply cumulatively. Art. 2(7) AI Act (as amended by Regulation (EU) 2026/1744) makes clear that Union data protection law continues to apply and that the AI Act does not affect the GDPR. The AI Act contains its own processing powers only in Art. 4a (processing special categories to detect bias in high-risk AI) and Art. 59 (AI regulatory sandboxes); the GDPR still applies there too. Neither matters for everyday use of ChatGPT or Copilot.

In practice: meeting an AI Act duty does not satisfy a GDPR duty and vice versa. An Art. 4 training record is not a legal basis, and a data processing agreement is not proof of AI literacy.

Roles

Who is who: controller, processor, deployer

Each regulation has its own roles. A company that buys and uses an AI tool usually holds two roles at once.

  • Art. 4(7) GDPR

    Controller

    Whoever determines the purposes and means of processing. If you use ChatGPT, Copilot or another tool for your own purposes, you are usually the controller for the personal data entered.

  • Art. 4(8), Art. 28 GDPR

    Processor

    A cloud vendor that processes data only on your behalf and on your instructions is a processor. A contract under Art. 28(3) GDPR is then required (as also stated in the DSK AI guidance, section 2.1).

  • Art. 26, Art. 28(10) GDPR

    Vendor's own purposes

    If the vendor uses your inputs for its own purposes, such as training, it no longer acts solely on your behalf in that respect. Depending on the set-up, the vendor may be a controller in its own right or a joint controller under Art. 26 GDPR. That disclosure then needs its own legal basis.

  • Art. 3(4) AI Act

    Deployer

    Whoever uses an AI system under its authority, except in the course of a personal non-professional activity. A company enabling Copilot for its staff is a deployer.

  • Art. 3(3) AI Act

    Provider

    Whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. If you build a customer chatbot on a language model and offer it under your own brand, you may be a provider yourself.

GDPR in practice

What the GDPR requires when using AI tools

  • Art. 6(1), Art. 9 GDPR

    Legal basis

    Every processing of personal data needs a legal basis, in companies often performance of a contract (point (b)) or legitimate interests after a balancing test (point (f)). For special categories such as health data, the narrow exceptions of Art. 9(2) apply in addition.

  • Art. 28(1) and (3) GDPR

    Data processing agreement

    With a vendor processing on your behalf you sign a DPA. Among other things it must provide that data is processed only on documented instructions (Art. 28(3)(a)). Check whether the chosen product and plan include a DPA.

  • Art. 44 to 46 GDPR

    International transfers

    If data is processed outside the EEA, a basis under Chapter V is needed: an adequacy decision (Art. 45), for the US Decision (EU) 2023/1795 for certified organisations, or appropriate safeguards such as standard contractual clauses (Art. 46(2)(c)). Check whether the vendor is certified and where processing takes place.

  • Art. 35 GDPR

    Data protection impact assessment

    Required where processing, in particular using new technologies, is likely to result in a high risk (para. 1), for example profiling as a basis for decisions or large-scale processing of special categories (para. 3). The DSK expects this to be the case "in many instances" for AI (AI guidance, section 2.3); the supervisory authorities' lists also apply (para. 4).

  • Art. 13, 14 GDPR

    Transparency

    Data subjects learn the purposes, legal basis, recipients and any intended third-country transfer (Art. 13(1)(c), (e), (f)). For automated decisions under Art. 22, meaningful information about the logic involved is added (Art. 13(2)(f), Art. 14(2)(g)).

  • Art. 15 to 21, Art. 28(3)(e) GDPR

    Data subject rights

    Access, rectification, erasure and objection also cover data in prompts, chat histories and outputs. The processor must assist you. Clarify in advance how you can find and delete chat histories.

Inputs and training

Keep personal data out of prompts, check training use

The safest route is not to enter personal data at all. This follows from data minimisation (Art. 5(1)(c) GDPR) and data protection by design and by default (Art. 25 GDPR). The DSK points out that removing names and addresses is often not enough, because the context can still identify a person (AI guidance, section 3.1).

Check whether the vendor uses inputs and outputs for training, whether it says so, and whether you can opt out. If opting out is not possible and personal data is affected, that purpose also needs a legal basis; tools that do not train on inputs and outputs are preferable from a data protection perspective (DSK AI guidance, section 1.9). Terms differ by product, plan and setting and change over time. Record the version you checked.

The DSK also recommends giving staff company devices and accounts rather than private ones (AI guidance, section 2.4). Private accounts of staff are also usually not covered by the contract your company has signed with the vendor.

Decisions

No solely automated final decision (Art. 22 GDPR)

Data subjects have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them (Art. 22(1) GDPR). Exceptions exist only for entering into or performing a contract, authorisation by law or explicit consent (Art. 22(2)). In the contract and consent cases, at least the right to obtain human intervention applies (Art. 22(3)); where the decision is authorised by law, that law itself must lay down suitable safeguards. Decisions based on special categories of personal data are only permitted with explicit consent or for reasons of substantial public interest, and with suitable safeguards (Art. 22(4)).

Where AI prepares decisions, the human must have real discretion; merely formal involvement is not enough. The DSK gives the example of an AI that evaluates applications and invites candidates to interviews on its own, and considers this a breach of Art. 22(1) (AI guidance, section 1.6).

AI Act

What the AI Act adds

  • Art. 4 AI Act

    AI literacy

    Providers and deployers take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. A particular level does not have to be guaranteed for each person (as amended by Regulation (EU) 2026/1744, in this version since 27 July 2026). The duty applies since 2 February 2025 (Art. 113(3)(a)); until 26 July 2026, Art. 4 required ensuring, to their best extent, a sufficient level of AI literacy.

  • Art. 50(4) AI Act

    Disclosure by deployers

    If you generate deep fakes (image, audio, video) with AI, you disclose it. If you publish AI-generated text to inform the public on matters of public interest, you disclose it too, unless the text underwent human review or editorial control and someone holds editorial responsibility. Applies since 2 August 2026 (Art. 113).

  • Art. 50(1) AI Act

    Chatbots

    Ensuring that people are informed they are interacting with AI is the provider's duty. If you build your own chatbot and offer it under your own name, that duty may fall on you as provider.

  • Art. 26, Art. 25(1)(c) AI Act

    High-risk use

    If you use an AI tool for an Annex III purpose, such as selecting applicants, the deployer obligations under Art. 26 apply from 2 December 2027 (Art. 113(3)(c) as amended). Whoever changes the intended purpose of a general AI system so that it becomes high-risk is considered a provider.

Art. 26(9) AI Act links both worlds: deployers of high-risk AI use the provider's information for their data protection impact assessment under Art. 35 GDPR. Deployers of Annex III systems that make or assist decisions about people also inform those people (Art. 26(11)).

Checklist

Before rolling out ChatGPT, Copilot and similar tools

These points should be clarified and documented before an AI tool is approved in your company:

  • Define the purposes and check whether personal data is involved (DSK AI guidance, sections 1.1 to 1.3).
  • Determine the legal basis per purpose and add it to the record of processing activities (Art. 6, Art. 30 GDPR).
  • Clarify the vendor's role and sign a DPA where it processes on your behalf (Art. 28(3) GDPR).
  • Check where processing happens and the transfer basis, e.g. an adequacy decision or standard contractual clauses (Art. 44 to 46 GDPR).
  • Check training use of inputs and opt out where possible; decide how chat histories are stored (DSK AI guidance, sections 1.9 and 1.10).
  • Run a threshold assessment and carry out a DPIA where a high risk is likely (Art. 35 GDPR).
  • Adopt an internal AI policy covering personal data in prompts, company accounts and review of outputs (Art. 5(1)(c), Art. 25 GDPR; DSK AI guidance, sections 2.2 and 2.4).
  • Update privacy notices and organise data subject rights (Art. 13 to 21 GDPR).
  • Take AI literacy measures, e.g. training (Art. 4 AI Act), and document them as evidence (recommended); include the Art. 50(4) AI Act disclosure duties in the policy.
  • Involve the data protection officer and, where one exists, the works council (DSK AI guidance, section 1.12).

The checklist does not replace a case-by-case assessment. For Annex III high-risk purposes, the deployer obligations under Art. 26 AI Act apply in addition.

Deadlines

What applies since when

GDPR, all obligations mentioned here
DateSince 25 May 2018
SourceArt. 99(2) GDPR
AI literacy (Art. 4 AI Act)
DateSince 2 February 2025
SourceArt. 113(3)(a) AI Act
Transparency obligations (Art. 50 AI Act)
DateSince 2 August 2026
SourceArt. 113 AI Act
Machine-readable marking for systems placed on the market before 2 August 2026 (provider duty)
Date2 December 2026
SourceArt. 111(4) AI Act as amended
Deployer obligations for Annex III high-risk AI
Date2 December 2027
SourceArt. 113(3)(c)(i) AI Act as amended

Implementation

How SimpleAct brings data protection and the AI Act together

  • AI register

    Record tools

    ChatGPT, Copilot and other tools with purpose, role, data categories, vendor and risk class in one register.

  • GDPR module (from Professional)

    Link RoPA, DPA, DPIA

    From the Professional plan, each AI entry can be linked to the processing activity, the processor agreement and the impact assessment.

  • Evidence

    Store measures and evidence

    Store measures and evidence with each AI system; templates for the AI policy and the training record are free. Training via the Academy is part of the Enterprise plan.

FAQ

Frequently asked questions on GDPR and AI

Yes, if the GDPR obligations are met: a legal basis for every processing of personal data (Art. 6 GDPR), a DPA with the vendor where it processes on your behalf (Art. 28), safeguarded third-country transfers (Art. 44 et seq.), information for data subjects (Art. 13 and 14) and a DPIA where the risk is high (Art. 35). Whether a specific product allows this depends on contract, plan and settings.
If the vendor processes personal data on your behalf, yes (Art. 28(3) GDPR). The DSK often assumes processing on behalf when AI is used as a cloud service (AI guidance, section 2.1). If the vendor also uses the data for its own purposes, a DPA alone is not enough.
Only if there is a legal basis and the other requirements are met. It is better to leave personal data out (Art. 5(1)(c) GDPR). Removing names is often not enough if the person can be identified from the context (DSK AI guidance, section 3.1). Set this out in an AI policy.
Not automatically. A DPIA is required where the specific processing is likely to result in a high risk (Art. 35(1) GDPR), for example profiling as a basis for decisions or large-scale processing of health data (para. 3). According to the DSK this will often be the case for AI (AI guidance, section 2.3).
No. Both apply side by side; the AI Act does not affect the GDPR (Art. 2(7) AI Act as amended by Regulation (EU) 2026/1744). The AI Act adds its own duties, such as AI literacy (Art. 4) and transparency (Art. 50).
Under Art. 50(4) AI Act only in certain cases: for deep fakes and for texts published to inform the public on matters of public interest. For texts the duty does not apply if they underwent human review or editorial control and someone holds editorial responsibility.
Solely automated decisions with legal or similarly significant effects are only permitted within the exceptions of Art. 22(2) GDPR. A human must genuinely be able to decide (DSK AI guidance, section 1.6). For candidate selection, the high-risk obligations under Art. 26 AI Act apply in addition from 2 December 2027.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

As of · SimpleAct editorial team

Editorial information, not legal advice. The text published in the Official Journal is authoritative; interpretation and national implementation can differ in individual cases. For specific questions, seek legal advice.

Keep reading

AI use and data protection in one place

We will show you how to record AI tools, link them to RoPA, DPA and DPIA (from Professional), and store measures and evidence with each AI system.

Book a demoTry 7 days (credit card required)