What should you assess before using AI tools with personal data?

Published 19 October 2026

Summary: Before you use an AI tool with personal data, answer five questions: what is the purpose, what is the legal basis, what role does the supplier have and does it train its models on your data, does the data end up in a third country, and is a high risk likely so that a data protection impact assessment (DPIA) is required. The GDPR applies in full when AI processes personal data, and the AI Act adds its own requirements; its transparency obligations in Article 50 have applied since 2 August 2026. Document the answers before the tool goes live.

Start with the purpose and the data that goes into the tool

Personal data must be collected for specified, explicit and legitimate purposes (Article 5(1)(b)) and be adequate, relevant and limited to what is necessary (Article 5(1)(c)). With AI, the use case matters more than the tool. Summarising an internal meeting is not the same as sorting job applications, even with the same service.

So map what is actually sent in and stored:

• text and questions that users type in;
• uploaded documents and emails, and content the tool retrieves itself;
• meeting recordings and transcripts;
• the answers, which may contain personal data and are kept in the history.

If you lack an overview of which AI tools are in use, start with an AI inventory.

Legal basis and information to data subjects

Every processing activity needs one of the legal bases in Article 6(1), and the GDPR names no basis that applies to AI in general. For some internal AI tools in private organisations, legitimate interests (Article 6(1)(f)) can be a relevant basis, but it has to be assessed for the specific use case, and it does not apply to processing by public authorities in the performance of their tasks. Municipal companies need to assess which basis applies to them.

European Data Protection Board (EDPB) Opinion 28/2024 on AI models sets out three steps for legitimate interests: the interest is legitimate, the processing is necessary for it, and the data subjects’ interests, rights and freedoms do not override it, with weight on their reasonable expectations. Document the assessment.

Articles 13 and 14 require information on, among other things, the purposes, the legal basis and the recipients. If solely automated decisions produce legal effects or similarly significantly affect someone, Article 22 applies, and you must also give meaningful information about the logic involved.

The supplier: processor terms and training on your data

When the supplier processes personal data on your behalf it is a processor, and Article 28(3) requires a contract under which the processor acts only on your documented instructions. If the supplier may use your data for its own purposes, for example to train its models, it decides that purpose itself and is not only a processor for that part. Under Article 28(10), a processor that infringes the GDPR by determining the purposes and means is considered a controller for that processing.

Check in the terms:

• that there is a data processing agreement that covers the AI feature, not just the core service;
• whether prompts, files and answers are used to train or improve the supplier’s models, and whether that can be switched off;
• whether the consumer and business versions of the service have different terms;
• which sub-processors are used and how you are told about changes (Article 28(2));
• how long prompts and answers are kept, and that the data is deleted or returned when the contract ends (Article 28(3)(g)).

Microsoft, for example, states that prompts, responses and data accessed through Microsoft Graph in Microsoft Copilot are not used to train the foundation models. Find the equivalent statement for each tool.

According to the EDPB opinion, supervisory authorities may also consider whether you, when deploying a model developed by someone else, have made an appropriate assessment that it was not developed by unlawfully processing personal data. Its depth depends on the risks.

Does the data end up in a third country?

Chapter V of the GDPR applies when personal data is made available to a recipient outside the EU/EEA (Article 44), including through sub-processors. A transfer can rely on an adequacy decision (Article 45). For the United States, the Commission’s decision covers organisations participating in the EU-US Data Privacy Framework, so check that the specific recipient is certified. Otherwise, appropriate safeguards under Article 46 are needed, usually the Commission’s standard contractual clauses, and an assessment of the destination country under EDPB Recommendations 01/2020.

Storing files in the EU is not always enough. Microsoft states, for example, that some third-party AI models, which Microsoft uses as sub-processors, are currently excluded from the EU Data Boundary. For customers in the EU/EFTA those models are off by default and are only used if an administrator turns them on. With the flex routing setting, the AI processing in Copilot itself can also take place in the United States, Canada or Australia during periods of peak demand; it is on by default for tenants created after 25 March 2026. So the model chosen and the tenant’s settings can affect where the data is processed, and you should check the current documentation and the settings before the tool is approved.

When is a data protection impact assessment required?

Article 35(1) requires a DPIA when a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. The list from IMY (the Swedish Authority for Privacy Protection) has nine criteria, and as a main rule a DPIA is required if at least two are met. New technology is one of them, so if the AI use counts as new technology, one more criterion is enough, for example:

• evaluating or scoring people, such as screening job applicants;
• people in a vulnerable or dependent position, such as employees, children or patients;
• sensitive personal data or data of a highly personal nature;
• large-scale processing, or combining data in ways the data subjects could not have expected.

The assessment must include, among other things, a description of the processing, an assessment of necessity and proportionality, a risk assessment and the measures you plan (Article 35(7)). If the assessment shows a high risk that you cannot reduce, you must consult IMY before you start (Article 36). If an existing system gains new AI features, an earlier DPIA may need to be updated.

The AI Act: transparency duties and dates

The AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR. Its dates have been amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026. It did not postpone the transparency obligations in Article 50, which have applied since 2 August 2026:

• Providers of AI systems that interact directly with people must ensure they are told they are interacting with an AI system, unless this is obvious (Article 50(1)).
• Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format (Article 50(2)). Systems placed on the market before 2 August 2026 have until 2 December 2026.
• Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them (Article 50(3)).
• Deployers must disclose deep fakes, and AI-generated text published to inform the public on matters of public interest unless the text has undergone human review and someone holds editorial responsibility (Article 50(4)).

An organisation that uses an AI system under its authority in its own activities is a deployer (Article 3(4)). If you have an AI system developed, for example a chatbot on your website, and put it into service under your own name or trademark, you may instead be a provider (Article 3(3)). The requirements for high-risk systems under Annex III, which includes AI for recruitment and selection, apply from 2 December 2027. Providers and deployers must also take measures to support the AI literacy of their staff (Article 4 as amended).

Checklist before the tool is put into use

1. The use case, the purpose and the personal data sent in are described.
2. The legal basis is chosen and, for legitimate interests, documented.
3. The information to data subjects is updated.
4. A data processing agreement covers the AI feature, and training on your data is clarified.
5. Sub-processors and any third-country transfers are known and supported under Chapter V.
6. The need for a DPIA is assessed and documented, even when the answer is no.
7. The transparency obligations in Article 50 are checked for the use cases where they apply.
8. The processing is in the record of processing activities and in your AI inventory.

Introducing an AI tool that processes personal data? We help you assess the legal basis, supplier terms and transfers, and carry out a data protection impact assessment (DPIA) when one is needed. Read more about our work in data protection and privacy, or contact us.

Sources: Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2026/1744; EDPB Opinion 28/2024 and Recommendations 01/2020; IMY on DPIAs and its list under Article 35(4) and on third-country transfers; European Commission, Adequacy decisions; Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot, the pages on AI providers as sub-processors and Flex routing (EU and EFTA). Verified 2026-10-03.

This text is general information, not legal advice. Rules, guidance and supplier terms for AI change quickly; always assess your own use case.