AI and GDPR — a contradiction?
Many companies hesitate to deploy AI agents because they fear data protection problems. ChatGPT here, a cloud API there — and suddenly customer data ends up on US servers without anyone in the company having consciously decided it. The concern is justified: according to a Bitkom study, 62 percent of German companies cite data protection concerns as the main reason they do not yet use AI.
The good news: AI and GDPR are not mutually exclusive. With the right architecture, the right contracts and a clear process, you can use AI automation without breaking applicable law. This guide shows you how.
The 5 GDPR requirements for AI
Before you deploy an AI tool in your company, five central GDPR requirements must be met. They apply regardless of whether you use a Claude API, a self-hosted service or a SaaS product:
- Legal basis (Art. 6 GDPR) Every processing of personal data needs a legal basis. In practice, three variants usually apply when using AI in a company: Performance of a contract (Art. 6(1)(b)) — when the AI handles customer requests arising from a contractual relationship. Legitimate interest (Art. 6(1)(f)) — when the AI optimises internal processes and the interests of the data subjects do not override. Consent (Art. 6(1)(a)) — rarely needed, but relevant for proactive outreach or marketing automation.
- Data processing agreement (DPA) As soon as an external service processes personal data on your behalf, a DPA under Art. 28 GDPR is mandatory. This applies to every cloud-based AI API. The DPA governs the purpose of processing, technical and organisational measures, sub-processors and the ban on using data for the provider's own purposes (e.g. model training). Reputable providers such as Anthropic supply standardised DPAs.
- Data minimisation (Art. 5(1)(c)) Give the AI only the data that is actually required for the task at hand. An agent that classifies incoming emails needs the email text — but not the sender's bank details. Targeted prompt engineering and an MCP server architecture let you control data access precisely.
- Transparency (Art. 13/14 GDPR) Inform data subjects that AI is being used. In practice that means: update your privacy policy, display a notice for chatbots, communicate transparently in customer service. You do not have to disclose the exact algorithm — but you do have to disclose the fact that automated processing takes place.
- No fully automated individual decisions (Art. 22 GDPR) Decisions that significantly affect a person — credit checks, application rejections, contract terminations — must not be made solely by an AI. A human must make the final decision and be able to correct the AI's result. AI may prepare and recommend — but not decide alone.
The problem with US AI tools
Most well-known AI services — OpenAI (ChatGPT), Google Cloud AI, Amazon Bedrock — are US companies. That means that even if the servers are in the EU, these companies are subject to the US CLOUD Act and FISA Section 702. US authorities can in theory demand access to data without European data protection standards being observed.
The Schrems II ruling of the CJEU (Court of Justice of the EU) in 2020 invalidated the Privacy Shield. Since then, data transfers to the US have been based on standard contractual clauses (SCCs) and the EU-U.S. Data Privacy Framework introduced in 2023. However, data protection experts and supervisory authorities regularly point out that a residual risk remains — particularly for sensitive data.
Important: Every transfer of personal data to the US carries a residual risk — even with standard contractual clauses. For data that needs particular protection (health data, financial data, employee data), we recommend EU-based processing only.
That does not mean US tools are prohibited per se. But you should weigh it up carefully: which data is processed? How sensitive is it? And is there a European alternative that delivers the same result?
EU alternatives and a secure architecture
Technical developments over the last two years have made a fully EU-based AI infrastructure possible. Here are the building blocks we use in practice:
- Claude API with EU endpoints: Anthropic offers European data processing. The data does not leave the EU and is not used for model training. A DPA is available as standard.
- n8n self-hosted on EU servers: Workflow automation runs on your own servers in Frankfurt or Amsterdam. You keep full control over all data flows.
- Azure EU-West or Hetzner: For databases and data warehouses we use European data centres. Microsoft Azure EU-West (Netherlands/Ireland) or German providers such as Hetzner.
- On-premise for maximum security: For companies with particularly strict requirements — for example in healthcare or finance — a fully local installation is possible. The AI then runs on your own hardware.
EU hosting for servers and models significantly reduces the risk of third-country transfers. By combining European AI APIs, self-hosted workflow tools and EU servers, you can avoid much of the complexity around third-country transfers, SCCs and transfer impact assessments.
Checklist: using AI in a GDPR-compliant way
These ten points help ensure that your use of AI complies with data protection law:
-
check_circle
Sign a DPA with your AI provider: Check whether the provider supplies a data processing agreement. Look at the clauses on data use, sub-processors and deletion obligations.
-
check_circle
Ensure EU servers: Configure the AI API so that data is processed exclusively on EU servers. Avoid US fallback regions.
-
check_circle
Update your privacy policy: Add information on the use of AI to your privacy policy: purpose, legal basis, recipients, storage period.
-
check_circle
Extend your record of processing activities: Include the AI processing in your record of processing activities under Art. 30 GDPR.
-
check_circle
Implement data minimisation: Define exactly which data fields the AI may see. Filter, anonymise or pseudonymise data before passing it on.
-
check_circle
No AI training on customer data: Make sure the provider does not use your data to train its models. This must be fixed in the contract.
-
check_circle
Define escalation paths: Decide which decisions require a human to step in (Art. 22 GDPR). Document these rules in writing.
-
check_circle
Train employees: Raise your team's awareness of how to handle AI and data protection. Do not enter customer data into consumer tools such as ChatGPT.
-
check_circle
Audit regularly: Check every quarter whether your data protection measures still work. Technical and organisational measures keep evolving.
-
check_circle
Consider a DPIA: For extensive processing of personal data, a data protection impact assessment under Art. 35 GDPR may be required. Clarify this with your data protection officer.
The EU AI Act
The EU AI Act has been in force since August 2024. It takes a risk-based approach: the higher the risk of an AI application, the stricter the requirements. The good news for most companies: typical business applications such as email classification, data analysis or customer service bots fall into the minimal risk category — no additional obligations apply here beyond the GDPR.
High-risk applications — such as AI in recruitment, credit scoring or healthcare — are subject to extended requirements such as conformity assessment, documentation obligations and human oversight. Implementation deadlines are staggered up to 2027. We recommend keeping an eye on developments and acting early where necessary.
Practical example: GDPR-compliant AI integration
A mid-sized service company with 45 employees wanted to automate its customer service. Between 80 and 120 emails arrived every day and had to be sorted, answered and forwarded manually. Three employees together spent around six hours a day on it.
Our solution: an AI agent that reads and classifies incoming emails and answers standard enquiries automatically. The architecture:
- Claude API with EU endpoints for intelligent processing
- n8n self-hosted on a Hetzner server in Falkenstein for workflow orchestration
- An MCP server that connects the AI agent securely to the CRM system
- DPA with Anthropic signed, opt-out from model training confirmed
- Privacy policy updated, record of processing activities extended
The result: 70 percent of emails are answered automatically. All data stays in the EU. The data protection officer gave the green light. The three employees use the time they have gained for complex customer matters and strategic tasks.
Further reading
Using AI in a GDPR-compliant way?
In the free initial consultation, we show you how to use AI automation, with EU hosting and a clear data protection strategy.
Book an AI Check arrow_forwardFrequently asked questions
Is using AI GDPR-compliant?
Yes, the use of AI can be designed to comply with the GDPR. The prerequisites are a valid legal basis (e.g. performance of a contract or legitimate interest), a data processing agreement with the AI provider, data minimisation, transparency towards data subjects and compliance with Art. 22 GDPR for automated decisions. Ideally, you use EU servers to avoid data transfers to third countries.
Which AI tools are GDPR-compliant?
AI tools can be used in a GDPR-compliant way if they process data on EU servers, offer a data processing agreement and do not use customer data for their own training. Examples are the Claude API from Anthropic with EU endpoints, self-hosted n8n instances on EU servers and Azure services in the EU West region. What matters is not the tool alone, but the correct configuration and contractual safeguards.
Do I need a DPA for AI tools?
Yes. As soon as an external AI service processes personal data on your behalf, a data processing agreement (DPA) under Art. 28 GDPR is mandatory. This applies to all cloud-based AI APIs such as OpenAI, Anthropic or Google. Among other things, the DPA governs the purpose of processing, technical and organisational measures and the ban on using data for the provider's own purposes.