Guide
How to use AI in your company and stay GDPR compliant
AI gets no exemption from data protection law. With a few sound decisions you can use it with confidence. A practical guide, not legal advice.
The problem: your team already uses AI, approved or not
Someone pastes a client email into a free chatbot to help draft a reply. Someone else uploads a spreadsheet of patient data to “summarise it”. Nobody means harm, but the company has just shared personal data with a third party with no contract, no idea where it's stored and no guarantee it won't be used to train a model.
Banning AI rarely works: people use it anyway, just without oversight. The sensible route is to choose tools carefully, set a few simple rules and write them down.
How it works with Tessa
- 1
A processing agreement from day one
Tessera provides a data processing agreement (Art. 28), its list of sub-processors and a published security policy.
- 2
Data stored in the EU
What Tessa reads is stored encrypted on EU servers. If you prefer, analysis runs on a European AI model.
- 3
Minimisation by default
Before text reaches the model, email addresses and phone numbers are replaced with placeholders; the real data never leaves.
- 4
A person decides
Anything leaving the company waits for approval, and the control panel shows everything Tessa did and why.
What you get
- Private per personWhat Tessa reads from someone's email is visible only to them.
- No surveillanceThere are no individual metrics for managers.
- TraceabilityEvery action Tessa takes is logged with its reason.
- Control over what it learnsEveryone can see and delete what Tessa has learned about their style.
The basics: who's who under GDPR
When your company uses an AI tool with personal data (clients', employees' or suppliers'), your company is the controller: it decides what the data is used for. The tool's provider is normally a processor: it handles the data on your behalf and on your instructions.
Article 28 of the GDPR requires a data processing agreement (DPA) setting out what the provider may do with the data, which security measures it applies and which other providers (sub-processors) it relies on. If a tool doesn't offer one, don't use it with personal data.
A checklist for choosing an AI tool
Before connecting company email, meetings or documents, check:
- It offers a data processing agreement and an up-to-date list of sub-processors.
- Where data is stored: in the EU/EEA, or with valid safeguards for international transfers.
- Whether it uses your data to train its models, and whether you can opt out.
- How long it keeps data and how it's deleted when you leave.
- What access controls it has: who in your company can see what.
- Whether it logs what the AI does, so you can review it.
Minimisation: only the data you need
The data minimisation principle (Art. 5) is the easiest to forget with AI, because it's tempting to paste everything in. Some practical rules:
- Remove names, ID numbers, phone numbers and addresses when the task doesn't need them.
- Use pseudonymous labels (“client A”, “employee 3”) in analyses and summaries.
- Keep special categories of data (health, union membership, beliefs) out unless you have a clear legal basis and stronger safeguards.
- Limit what each integration can access: the AI doesn't need the whole company Drive.
Human oversight: AI suggests, a person decides
Article 22 of the GDPR protects people from decisions based solely on automated processing that significantly affect them. In practice: AI can summarise applications, draft replies or suggest priorities, but decisions about people (hiring, firing, granting or refusing something) are made by a person, and anything sent in the company's name is worth reviewing first.
Transparency and paperwork
What the law and common sense ask you to have in writing:
- Tell clients and staff that you use AI and what for (privacy notice, internal notice).
- Add the processing to your record of processing activities (Art. 30).
- Assess whether you need a data protection impact assessment (DPIA, Art. 35), for example for systematic processing of employee data or sensitive data at scale.
- A short internal policy: which tools are approved, which data must never go in and who to ask.
- Basic training for the team: the EU AI Act expects staff who use these systems to have sufficient AI literacy.
Things you should never do
Using AI to monitor staff (time, activity, individual productivity) raises serious data protection and employment law issues. Don't use free personal accounts with client data, and don't upload documents containing health data to tools without a contract. When in doubt, ask your data protection officer or a specialist lawyer; in Spain, the data protection authority (AEPD) publishes helpful guidance on AI, as do other EU regulators.
Where Tessa fits
Tessa is built around these rules from the start: a published data processing agreement, sub-processor list and security policy; data stored encrypted in the EU; the option to run analysis on a European model; email addresses and phone numbers masked before reaching the model; what it reads from each person kept private to them; no individual metrics for managers; and human approval for anything leaving the company. The control panel logs every action, and each person can see and delete what Tessa has learned about them.
Even so, how you use any tool remains your company's responsibility: this guide is for information and isn't a substitute for legal advice.
What Tessa reads for each person stays private, your data is stored in the EU and nothing goes out without your approval.
Frequently asked questions
Can we use ChatGPT or other AI with client data?
Only if the tool offers a data processing agreement, guarantees about where data is stored and doesn't train on it without your permission. Free personal accounts usually don't meet these requirements.
What is a data processor?
A company that processes personal data on behalf of another and on its instructions, such as a software provider. GDPR requires a contract between them (Art. 28).
Do I need a DPIA to use AI?
Not always. It's mandatory where processing is likely to be high-risk, for example sensitive data at scale or systematic processing of employee data. Assess it with your DPO or adviser.
Do we have to tell employees we use AI?
Yes. They need to know what data about them is processed, why and with which tools. Employment law also limits how far you can monitor workers' activity.
Where does Tessa store data?
Encrypted on EU servers. You can also ask for email, minutes and summary analysis to run on a European AI model.
Is this guide legal advice?
No. It's a practical, informational guide. For your specific situation, consult your data protection officer or a specialist lawyer.
Keep reading
- FeaturesEvery email that asks for something becomes a taskTessa reads your email and Slack, turns every request into a prioritized task with a due date and clears what's already done. Try it free.
- FeaturesTessa takes the notes, assigns the work and sends the recapTessa takes notes in your meetings, writes the minutes, assigns each action item to its owner and sends the recap to attendees. Try 14 days free.
- GuidesHow to manage email with AI without losing controlStop living in your inbox: a four-decision triage, email time blocks, filters worth setting up and how AI helps without taking control away from you.
- GuidesHow to write meeting minutes: a guide and a template to copyWrite clear meeting minutes: what to include, how to word decisions and action items, plus a ready-to-copy template you can start using today.
- GuidesHow to automate repetitive tasks without knowing how to codeHow to spot which tasks to automate, write them as “when X happens, do Y” rules and get started without code and without losing control of what gets sent.
What does your team look like?
Same AI for both. Where you start is what changes.
- Best fit for this page
Companies
30 to 250 people
What gets decided gets done
Minutes and tasks from every meeting, commitments that get followed up and a pulse per team, without watching anyone.
Startups
5 to 30 people
Grow without losing the thread
Tasks from email and Slack, follow-ups, sales and investors, without everything landing on the founders.
Try an AI assistant designed around GDPR from day one. Start free.
Start freeFree plan for teams of up to 3 people. Anything that leaves the company waits for your approval.