Does the GDPR apply if your company uses ChatGPT or other AI tools?
Yes, but not because you use an AI tool as such. The GDPR applies as soon as you process personal data, and that can happen just as easily in a word processor as in a chatbot. So it is not about which tool you use, but about what you put into it and what the tool does with it.
If you use AI only for general texts, summaries of public information or programming assistance without names, email addresses or other identifiable data, the GDPR does not touch that specific action. If you do enter data about customers, applicants or employees—for example to have an email drafted based on a customer file—you are processing personal data and the ordinary rules apply.
Where exactly is the difference
The distinction hinges on the content of what you enter, not on the label "AI". An installation company that has an offer description rewritten without a customer name operates differently from an HR manager who has a job application letter summarised with name, address and interview notes. In the first case there is nothing identifiable to a person. In the second case there is, and then the entry counts as processing.
The same applies to the output. An AI tool that generates a profile or recommendation based on entered customer data is processing that data further. This is relevant because the GDPR looks not only at storing data, but at every action: collecting, entering, having it processed by a third party, and using the output.
Who is then the data processor
Most AI tools that companies use run on servers of an external provider. If you enter personal data there, that provider is in practice often a data processor: a party that processes data on behalf of your company. That is the same role as with accounting software or a CRM system, only with AI tools it is less visible because the entry looks like loose text rather than a structured data file.
The EDPB and the Dutch Data Protection Authority draw attention to this because it is often unclear to users whether and how long entered data is retained, and whether it is used to train the underlying model. These are questions you will find in the provider's terms and conditions, and they determine whether a data processor agreement is needed. If you are unsure whether an agreement you have already signed covers this kind of use, you can have it checked in the knowledge base against the GDPR text.
When it does not affect you
If your company uses AI exclusively for tasks without identifiable data, such as generating general marketing texts, translating public product information or summarising your own internal processes without names, then for that specific application there is no processing of personal data and therefore no additional obligation under the GDPR. This does not mean that AI use in general escapes scrutiny; it means you need to look at each application to see what is actually being entered.
What this means in practice for your records
As soon as an AI tool processes personal data, that processing belongs in your processing activity register just like any other: which purpose, which data, which retention period and which party supplies the tool. Many companies overlook this because AI use often emerges ad hoc, via a separate employee account, without it being seen as a "system". Yet it counts just as much as a CRM or a payroll system.
Whether your company is actually affected by this depends on how AI is used within your organization and by whom. A director who occasionally has a text checked without customer data faces a different situation than an HR department that has job application data summarized. When in doubt, it's a worthwhile step to discuss this with a lawyer or the Dutch Data Protection Authority, especially when sensitive data such as health or financial information is involved.
Do you want to quickly clarify whether AI use within your company falls under the GDPR and what that entails? Take the free quick scan with a few questions and direct guidance, see how the underlying sources are built via an explanation of where the information comes from, or read the frequently asked questions if you first want to see how other business owners handle this.