AI and privacy: how to use customer data safely under the GDPR

Yes, you may process customer data with AI, as long as you follow the GDPR. AI does not change the basic rules; it only makes them more important because AI systems can process a lot of data simultaneously. With these seven rules, you're on the right track.

This article is general information and not legal advice.

1. Ensure a valid legal basis

For every processing, you need a reason recognized by the GDPR. For most SME applications, that is the performance of a contract (your customer wants an appointment) or a legitimate interest (you want to follow up on requests properly). For marketing, you often need consent.

2. Do not use more data than necessary

Only link the systems and fields necessary for the purpose. A daily turnover briefing does not need BSNs (Citizen Service Numbers) or medical data. Less data means less risk.

3. Sign a data processing agreement with every supplier

Every party that processes personal data for you (the AI supplier, the hosting party, the voice service) is a processor. You need a data processing agreement (DPA) with each of them. A good AI partner provides this as standard and specifies which sub-processors they use.

4. Pay attention to where the data is located

Storage and processing in the EU is the simplest. If a supplier is in the US, check if they fall under the EU-US Data Privacy Framework or have signed standard contractual clauses.

5. Agree on retention periods

Do not keep recordings, transcriptions, and chat conversations longer than necessary. Common practice is:

6. Secure it well

Encrypted connections, two-step verification, access only for those who need it, and a logbook of who views what. Ask your supplier how this is organized.

7. Be transparent in your privacy statement

Mention that you use AI, for what purpose, which data, and who your processors are. If you use an AI receptionist or chatbot, it must also state at the beginning of the conversation that it is an AI, according to the EU AI Act. See The EU AI Act for SMEs.

When do you need a DPIA?

A DPIA (data protection impact assessment) is mandatory if a processing is likely to result in a high risk for individuals. Think of processing health data on a large scale, systematic tracking of people, or combining many data sources about individuals. The Data Protection Authority publishes a list of processing operations for which a DPIA is mandatory. If you work in healthcare, also read AI in healthcare practice.

How a good AIOS builds in privacy

An AI Operating System brings data together, so privacy should be in the design: only linking the sources that are necessary, excluding sensitive fields, storage in the EU, roles and rights per employee, and fixed retention periods. At Tergem, your AIOS runs on your own accounts, so the data remains yours. Ask your privacy question in a non-binding conversation.