Data protection and AI: duties and safe use
Definition
Data protection and AI describes the handling of personal data when training and operating AI systems under the GDPR. It is about which data may be used for which purpose, on which legal basis, and with which safeguards. The EU AI Act sits alongside the GDPR here but does not replace it.
Why the Term Matters
Many AI ideas fail quietly because it only surfaces late that the intended data is personal and unusable without a basis. As a neutral advisor we clarify early which data may enter an AI project at all and how it is protected. That prevents a project breaking on data protection just before launch and creates a path that holds from the start.
When It Is Relevant
- An AI project should work with customer, staff or health data.
- An external AI service processes data outside your own system.
- The legal basis and purpose of the data use are still unclear.
- A data protection impact assessment might be needed and should be framed.
When Not
When an AI project works exclusively with anonymous or purely technical data, the data protection effort is small and a short framing suffices. And when it is not yet decided which use case gets built, the deep review is worthwhile only once the concrete data need is clear.
Industries That Use It
- Healthcare: patient data is specially protected, and every AI use needs a solid basis.
- Staffing providers: applicant and employee data is sensitive and tightly bound to purpose and consent.
- Retail and e-commerce: customer profiles and purchase history may enter AI only for a defined purpose.
- Housing management: tenant data in AI-supported processes needs clear legal bases.
Typical Use Cases
- A check whether intended data is personal and on what basis it could be used.
- Selecting an AI service by the location and type of its data processing.
- A framing of whether a data protection impact assessment is required.
- Measures such as pseudonymisation, access rights and deletion concepts for AI data.
- A data processing agreement with an external AI provider.
Decision Guide
| Signal | Data protection review fits | Alternative |
|---|---|---|
| Personal data planned | clarify basis before use | starting without review is risky |
| Only anonymous data | a short framing suffices | full review would be overbuilt |
| External AI service | check processing and location | agreeing blindly is dangerous |
| Use case still open | clarify data need first | review without a target runs empty |
Example
A healthcare provider wants to pre-sort appointment requests with AI. We check which fields are personal, which legal basis holds and whether an impact assessment is needed. The chosen service processes data in the EU, complemented by pseudonymisation and a deletion concept. This describes the method, not an asserted client metric.
Service Connection
The framing usually happens in AI consulting and EU AI Act consulting. Before rollout, the AI readiness check helps.
Sources
This framing describes common practice for the interplay of data protection and AI. Statements on the GDPR and EU AI Act are general orientation and not legal advice; they must be checked case by case against the currently applicable legal texts.