Using ChatGPT and co. in line with the GDPR: a guide for SMEs

Why this is urgent: shadow AI is widespread

The numbers are unambiguous. According to a Bitkom survey from summer 2025, employees in 8 percent of companies widely use private AI accounts for work, twice as many as the year before; in another 17 percent it happens in isolated cases, and a further 17 percent suspect it. At the same time only 23 percent of companies had rules for AI use, and only 26 percent officially provided generative AI to their staff. Use has grown further since: in summer 2026, according to Bitkom, 57 percent of companies with 20 or more employees used AI. The global KPMG study with the University of Melbourne (2025) completes the picture: 57 percent of employees who use AI at work hide it and present AI-generated work as their own, and in Germany 43 percent of respondents use AI tools without questioning the results.

What the data protection authorities say

The authoritative references in Germany are the guidance documents of the Datenschutzkonferenz (DSK), the conference of German data protection authorities. The guidance on AI and data protection of 6 May 2024 is aimed at controllers that use AI applications. The guidance on technical and organisational measures for developing and operating AI systems of June 2025 is aimed mainly at manufacturers and developers. Since October 2025 there has also been guidance on AI systems using the RAG method, i.e. connected to your own documents. Follow these papers and you have the supervisory authorities’ expectations on the table.

• Clarify the legal basis: processing personal data in AI tools needs a basis under Art. 6 GDPR, in day-to-day business often contract performance or legitimate interest with a documented balancing test. Special categories such as health data are additionally subject to the stricter rules of Art. 9.
• Take data minimisation seriously: not every prompt needs real names. Where possible, leave out or pseudonymise personal data.
• Keep data subject rights in mind: access, rectification and erasure must work even when data has flowed through AI tools.
• No automated final decision: decisions with legal or similarly significant effect are, as a rule, made by a human (Art. 22 GDPR). According to the DSK, a merely formal human involvement is not enough.
• Check the impact assessment: extensive or sensitive processing may require a data protection impact assessment under Art. 35 GDPR.

The data processing agreement: what you need in writing

As soon as an AI provider processes personal data on your behalf, Art. 28 GDPR requires a data processing agreement with the legally required minimum content. The big providers offer one to their business customers: OpenAI concludes a data processing addendum for ChatGPT Business, Enterprise and the API, at Anthropic it is part of the commercial terms, at Microsoft it is the Data Protection Addendum. Check three points:

• Training excluded: the tier must commit that your inputs are not used to train the models by default. OpenAI, Anthropic and Microsoft commit to this for their business offerings; exceptions apply, for example, to content you explicitly share as feedback. Consumer tiers and private accounts often lack this, which is exactly why they are off-limits for company data.
• Sub-processors: the data processing agreement lists which service providers the vendor uses and where processing happens.
• Processing location and transfer mechanism: with US providers you additionally need a basis for the third-country transfer, currently usually the EU-US Data Privacy Framework, whose confirmation is under appeal at the Court of Justice of the EU, or standard contractual clauses. The alternative is genuine EU processing.

EU hosting options compared

If you want to defuse the third-country debate, choose offerings where processing demonstrably happens in the EU. The main options, as of September 2026:

Getting shadow AI under control: offering beats banning

• Provide an official tool: a business tier with a data processing agreement and training exclusion for everyone who needs AI day to day. The DSK recommends company accounts, for external services ideally without individual employees’ names and with training and input history switched off. That removes the reason for shadow use.
• Explicitly exclude private accounts: company data never belongs in private AI accounts; communicate that in writing and with reasons.
• Check instead of blindly adopting: AI results are drafts. Reusing them unchecked risks errors with external impact; the 43 percent from the KPMG study are a warning.
• Build AI literacy: the AI literacy obligation under Art. 4 of the EU AI Act has applied since February 2025. Since the Digital Omnibus on AI (27 July 2026) it requires measures that support AI literacy rather than a guaranteed level; no certificate is needed. A short, recurring training session is the obvious route and lowers the risk.

The company AI policy: 10 points that belong in it

• 1. Which AI tools and tiers are officially approved, including their configuration state.
• 2. That private AI accounts are off-limits for company data, without exception.
• 3. Which data categories may go into AI tools and which never (such as health data, credentials, trade secrets).
• 4. That personal data is left out or pseudonymised where possible.
• 5. That AI results are checked by someone with the relevant expertise before reuse, with clear responsibility.
• 6. When AI use is disclosed to customers or recipients, including the information and labelling duties under Art. 50 of the AI Act, which have applied since 2 August 2026.
• 7. Who in the company is responsible for AI questions and approvals.
• 8. How new AI tools are requested and vetted (data processing agreement, training exclusion, processing location).
• 9. What happens in case of incidents: report to the responsible contact in the company, where applicable the data breach process.
• 10. That the policy is reviewed regularly, because tiers, models and the legal situation change quickly.

What the EU AI Act additionally requires: the short version

The GDPR is one half, the EU AI Act the other. Short version for AI users after the Digital Omnibus on AI, in force since 27 July 2026: the prohibitions and the AI literacy obligation have applied since February 2025, the latter since the Omnibus as a duty to take measures. The transparency and labelling duties under Art. 50 have applied since 2 August 2026 (providers of generative systems already on the market have until 2 December 2026 for machine-readable marking), and the high-risk obligations were postponed to 2 December 2027 and 2 August 2028 respectively. The GDPR itself is unchanged; the amendments proposed by the Commission in November 2025 have not been adopted as of September 2026. The full timeline with all duties is in the article The EU AI Act for SMEs.

And if your data protection requirements are especially high, look at a setup where the data never leaves the building in the first place: the local AI versus cloud AI cost comparison shows from what point your own AI server pays off. I build both, properly configured cloud AI and local setups, as part of my AI automation services.