A guide for executives, CIOs, CISOs and DPOs
AI and GDPR: using ChatGPT, Claude or Copilot without taking unnecessary risks
Using generative AI at work is compatible with the GDPR if you choose a business plan with a data processing agreement (DPA), configure retention and training, and decide which data goes into which tool. The GDPR targets less the tool than what your teams put into it.
01The framework
What the GDPR changes when you use an AI tool
The GDPR applies as soon as personal data goes into an AI tool: a name, an email address, a résumé. It doesn't ban the tool; it requires you to know who does what with that data.
You remain responsible
Your company is the data controller. On a business plan, the vendor is a processor: a contract (DPA, Article 28 of the GDPR) sets out what it may do.
A legal basis for each use
Each use has its legal basis, often legitimate interest or contract, and its entry in the record of processing activities.
Data minimization
Send only what the task needs. "Client A" instead of a name is often enough.
Transfers outside the EU
OpenAI, Anthropic and Microsoft are American. Transfers rely on the Data Privacy Framework, upheld by the EU General Court on September 3, 2025 (appeal pending), or on standard contractual clauses.
People are informed
If customer or employee data goes into the tool, your privacy policy says so.
02The question
Is ChatGPT GDPR compliant?
No tool is "GDPR compliant" in itself: it is your use that is, or isn't. The difference lies between consumer plans and business plans.
- Consumer plans (ChatGPT Free or Plus, Claude Free, Pro or Max): no data processing agreement, training set account by account. At Anthropic, a conversation used for training can be kept for up to 5 years.
- Business plans (ChatGPT Business or Enterprise, Claude Team or Enterprise, Microsoft 365 Copilot): DPA, no training on your data by default, accounts managed by the company.
- Worth knowing: in Microsoft 365 Copilot, Anthropic's models are excluded from the EU Data Boundary, Microsoft's commitment to process data within the EU.
Choosing and configuring Claude Team and Enterprise plans is covered separately.
Sources consulted on October 11, 2026: OpenAI, Anthropic, Microsoft.
03The grid
Which data goes into which AI tool?
Decide by data type, not by tool. Here is our starting grid, to be adjusted with your DPO.
| Data | Personal account, consumer plan | Configured business plan |
|---|---|---|
| Public: website, brochure, published offer | yes | yes |
| Internal: processes, notes, drafts | no | yes |
| Confidential: contracts, figures, code | no | yes, if your policy allows it |
| Personal: customers, employees, candidates | no | yes, with a legal basis, minimal data and notice |
| Sensitive: health, opinions, criminal convictions | no | case by case, after DPO review and a DPIA |
The CNIL (France's data protection authority) takes the same view: on a consumer service, never share personal data or information covered by confidentiality, such as trade secrets.
04The settings
6 things to check before rolling out an AI tool
Before opening accounts, and again at every plan change, your CIO or CISO checks six settings.
The DPA
A signed data processing agreement, with the list of sub-processors.
Location
Where data is stored and processed, and on what basis it leaves the EU.
Training
Turned off for the whole organization, including the feedback button, which can allow it.
Retention
How long conversations and files are kept, set by the administrator when the plan allows it.
Accounts
SSO login with the work email address. No personal accounts for work.
Logs and connectors
Who reads the activity logs, and which sources the tool can access: email, drive, CRM.
With AI agents, this point becomes central: an agent reads and acts across several tools (CNIL note of July 20, 2026).
05The AI Act
GDPR and AI Act: what each one adds
The GDPR protects personal data; the AI Act regulates AI systems according to their level of risk. Both apply together.
- AI literacy (Article 4): since February 2, 2025, build your teams' AI literacy. The omnibus regulation, in force since July 27, 2026, relaxed this obligation without removing it.
- Transparency (Article 50): tell people when they are interacting with an AI, and label certain generated content, such as deepfakes.
- High risk: screening résumés or evaluating employees falls under Annex III. These obligations apply from December 2, 2027.
For writing, summarizing or translating, the GDPR therefore remains the main concern, plus training your teams.
Sources consulted on October 11, 2026: CNIL, European Commission, EUR-Lex.
06The method
AI and GDPR checklist: what your teams do on Monday morning
Getting compliant takes five steps, with the DPO, IT and business teams. The most often forgotten: writing the rule down.
Checklist: before rolling out an AI tool company-wide
- List the uses
- who uses which tool, for which task, with which data. Without penalties, otherwise hidden uses stay hidden.
- Choose the plan
- a business plan with a DPA, then the six settings above.
- Document
- each use in the record, with its legal basis. A DPIA when the risk is high: sensitive data, evaluation or monitoring of people.
- Inform
- update the privacy policy and the information given to employees.
- Write the rule
- which data goes into which tool, who approves: write the rule into an AI usage policy, then train your teams.
We can run this review with your CIO, CISO and DPO, on your tools and your data.
Book 20 minutesKailli, an applied AI transformation firm, helps companies that already use AI decide which data goes into which tool. It sells no tools.
This content is not legal advice. Have your rules validated by your legal counsel or your DPO.
Frequently asked questions about AI and GDPR
Is ChatGPT GDPR compliant?
ChatGPT is neither compliant nor non-compliant in itself: what matters is how it is used. ChatGPT Business and Enterprise include a data processing agreement and don't train models on your data by default. A personal account is not suitable for the company's personal data.
Which AI tools are GDPR compliant?
No tool carries a "GDPR compliant" label. Look for a business plan with a data processing agreement, training turned off, configurable retention and safeguarded transfers outside the EU. Configuration and usage rules remain your responsibility.
Is AI confidential?
Not by default. What you type is sent to the vendor, kept for a while and, on a personal account, may be used to train its models. On a configured business plan, your data stays under contract.
Can you put customer data into Claude?
Yes, with Claude Team, Enterprise or the API, under a data processing agreement, if the use has a legal basis and you send only what is necessary. Not with a personal Claude account. For sensitive data, consult your DPO first.
Do you need a DPIA to use AI?
Not for every use. A data protection impact assessment (DPIA) is mandatory when processing presents a high risk: sensitive data at scale, evaluation or monitoring of employees. The CNIL recommends involving the DPO in any generative AI rollout.
Who is liable in case of a data breach?
Your company, as data controller: it notifies the CNIL within 72 hours if the breach poses a risk to individuals. The vendor, as processor, must alert you and is liable for its own failures.
Twenty minutes. And you'll know whether we can help.
No sales pitch. You tell us where you stand with AI, we tell you how far you can go.
Your booking details
20 minPick your day
Loading time slots…
No time slots available this month.
I can't load the time slots right now.
Online booking opens soon.
- 1 · Tell me who you are (done)
- 2 · Pick your day
- 3 · See you soon
Pick a day in orange to see the available times.
Available times
Times shown in your time zone:
This slot was just taken. Pick another one: the list is up to date.
The booking couldn't go through. Try again in a moment, or book directly on Cal.com.
See you soon!
Your call:
Your confirmation is on its way by email.