This article is practical guidance and not legal advice. For binding statements, contact your data protection officer or legal counsel.
Check points before use
Which data? Personal, confidential or secret data does not belong in a service without review.
Which offering? Personal and business access and interfaces have different terms.
Training and storage: Are inputs used for training, how long are they stored?
Data processing agreement: Is there a contract, and who are the subprocessors?
Processing location: Where is data processed, and how are third-country transfers handled?
Access: Who in the company may use the service, and how are accounts managed?
Documentation: Record the processing in the register and inform data subjects where necessary.
Technical safeguards
Central sign-in with multi-factor authentication instead of personal accounts.
Access rights by the principle of least privilege, especially when connecting documents.
Rules against data leakage and logging of use.
Consider local models for particularly sensitive tasks.
Terms change
Providers adjust terms, products and locations. Check the current state before use and at regular intervals. We deliberately make no claims about individual providers here.
AI data protectionGDPR AIChatGPT data protection businessdata processing agreement AIAI check pointsAI data leakage
Frequently asked questions
May I enter personal data into ChatGPT?
That depends on offering, contract and legal basis and should be clarified beforehand. Better not without review.
Do I need a data processing agreement for AI services?
If personal data is processed on your behalf, usually yes. Have it checked case by case.
Does local AI help with data protection?
It reduces disclosure to external services but does not replace checking legal basis, access and operations.