AI, privacy, GDPR

Can we use AI on customer data under the GDPR?

Yes, if you treat the AI tool like any other system that handles personal data: a lawful basis for the purpose, a data processing agreement with the provider, a clear answer to where the data is processed and whether it trains anything, and a line in your privacy notice. The usual mistake is customer data pasted into a free chat tool that nobody in the company has approved.

Published: September 27, 2026

Treat it like any other system that handles personal data

The GDPR has no special chapter for language models. The questions are the ones you already answer for your CRM or your accounting system:

Purpose and lawful basis. Answering a customer’s question with help from AI is usually the same purpose the data was collected for. Using the same emails to train a model for something else is a new purpose, and needs its own basis.
Data minimisation. Send the model what the task needs. An agent that answers questions about opening hours does not need the customer’s address.
Transparency. Your privacy notice should say that you use AI, for what, and which provider processes the data.
Retention. Prompts, answers and logs are personal data too, and they are usually kept longer than anyone intended.

Four questions to ask the provider

Do you use our data to train your models? The answer should be no, and it should be in the agreement rather than only in a blog post.
Where is the data processed and stored, and for how long? Many providers keep inputs for a period for abuse monitoring even when they do not train on them.
Is there a data processing agreement, and who are your sub-processors?
How do we delete data, and how do we get it out? A customer who asks to be deleted means everywhere, the logs included.

Where it goes wrong

A free chat tool nobody approved. A common leak is a helpful employee pasting a complaint, name and order number included, into a personal account.
Sensitive data by accident. A message about a booking can mention a health condition. Decide in advance what the agent does with it, and keep it out of the logs.
An agent that decides alone. Decisions with legal or similarly significant effects on a person, such as turning down a loan application or a job applicant, have their own rules in article 22 and usually need a person to make or check them.
Logs nobody thought about. The conversation history is stored somewhere, often with a third provider for monitoring. It belongs on the same list of processors as the model.

How we choose, when we build it

We choose the provider by what the data is. Generated marketing copy can come from whichever model writes it best. A customer’s question about their own booking goes to a provider with an agreement, a location and a retention period we can name, and the agent only sees the fields it needs. That is cheaper to decide at the start than to change later.

If you are planning an agent or an automation that touches customer data, describe it in the Living Brief and you get an architecture sketch with the data flow drawn in, phases and a range in weeks. If you are not sure where AI would help, the free AI review starts from the business instead.

This note is a practical checklist, not legal advice. For a specific case, Datatilsynet’s guidance and a lawyer who knows your sector are the right sources.

Field notes

Questions we get

The same questions, every time. These are the answers we give across a table.

Can staff use ChatGPT with customer data?

Not in a personal or free account. Consumer chat services can keep conversations and may use them to improve their models, and your company has no data processing agreement that covers them. Business and API plans usually come with one and do not train on your data by default, but read the terms of the plan you actually buy before anyone pastes in a customer’s details.

Do we need a data processing agreement with the AI provider?

Yes, whenever the provider processes personal data on your behalf, which it does as soon as a prompt or a document contains any. Article 28 of the GDPR requires the agreement in writing. The large providers publish one: accept it, keep a copy, and note who their sub-processors are.

Is it a problem that the provider is American?

Not in itself, but the transfer out of the EEA needs a legal basis. For a US company certified under the EU–US Data Privacy Framework that basis exists; otherwise it is standard contractual clauses and an assessment of the risk. The two arrangements before the framework were both struck down by the EU Court of Justice, so for sensitive data many choose a provider that processes in the EEA and skip the question.

Do we need a DPIA?

Often. A data protection impact assessment is required when processing is likely to pose a high risk to people, and Datatilsynet publishes a list of processing that always needs one. AI that handles health data, monitors employees or decides things about people usually lands there. For a narrow tool it is a few pages of honest answers, written before launch.

What about the EU AI Act?

It regulates AI systems by risk, and the GDPR still applies in full next to it. For the tools most small businesses use (an agent answering customers, sorting email, drafting replies) the practical duties are modest: tell people when they are talking to a machine, and make sure the staff who use it understand what it can and cannot do. It is being phased in, and Norway takes it in through the EEA agreement, so check the status for your use before relying on a date.

Field notes