The most common mistake when using AI tools in the workplace is that employees enter personal data into a tool such as ChatGPT, Copilot or a similar chatbot, without the company knowing that this is happening. A CV, a client file or an email exchange is quickly summarized or rewritten, while no one has checked where that data ends up, who can access it and whether a processor agreement with the provider of that tool exists.
That is not a minor detail. As soon as a tool processes personal data, the same principles apply as with any other SaaS application: there must be a legal basis, the processing should be recorded in the processing register, and if the provider acts as a processor, a processor agreement should be in place. With many free AI tools, the latter is lacking, or the terms state that input may be used to train the model. This differs greatly by provider and subscription type, and is precisely why prior checks are necessary.
How this goes wrong in practice
In most cases, the problem does not arise from carelessness, but from lack of awareness. An HR officer pastes a job application letter into a chatbot to improve a job description. A project manager has a client email summarized. None of them think about the GDPR, because it feels like a tool and not like processing of personal data. The company itself often has no overview of which AI tools are used daily, let alone whether those tools are in the processing register or on some approved software list.
A second recurring mistake is that companies that do have an AI policy fail to align this policy with their existing processing register and processor agreements. The AI tool is then treated separately from the rest of the GDPR administration, while it is essentially the same question that also applies to any other SaaS tool: who processes what data, for what purpose, and on what basis. the knowledge base with explanations by topic also addresses this question for other widely used software, and shows that AI tools in practice are no exception to the system that already applies to other vendors.
Why it can involve personal data, even if that is not the intention
The GDPR uses a broad definition of personal data: any information that can be traced back to an identifiable natural person. A name, a customer number, a photo, a phone note or a combination of information that together identifies someone, falls under this. When using AI tools, it is therefore not only about explicit personal data such as a CV, but also about fragments hidden in a larger document, such as a name in an attachment that is copied along.
The Dutch Authority for Personal Data and the EDPB publish guidelines on dealing with AI and personal data, and these develop over time; what is considered standard interpretation today may be refined in some respects. This is one of the reasons why a fixed procedure within the company offers more guidance than loose agreements per employee.
How you can prevent this mistake
The core of the solution is simple to state, even if implementation takes time: identify which AI tools are used within the company, and establish for each tool whether personal data is entered. If so, that tool should be recorded in the processing register and, like other SaaS vendors, it should be checked whether the provider acts as a processor and whether a processor agreement is available. how data is protected with processors provides an overview of the points that are relevant in this regard.
In addition, a brief, concrete instruction to staff is more effective than an extensive policy document that no one reads: which tools are permitted, what data can and cannot be entered into them, and who a staff member should contact if in doubt. This last step may well be the most important, because most errors do not arise from unwillingness but from the lack of a clear point of contact.
If it has already happened
If a large amount of personal data has unintentionally been entered into an AI tool without a data processing agreement in place for it, it is advisable to assess whether this qualifies as an event requiring a response, for example in the context of the obligation to notify data breaches. get a first indication in a few questions can provide an initial point of reference in this regard, regardless of whether notification is necessary in a specific case; that assessment is the responsibility of the controller itself or a lawyer.
Would you like to draw up a list for your own business of which tools, including AI applications, require attention? Do the free quick-scan or read the topics in frequently asked questions about GDPR and software to see what your situation requires.