Data protection is the biggest obstacle to using AI: according to Bitkom, 66 percent of companies already using AI name it. In 2024, Germany's data protection authorities published guidance on "Artificial intelligence and data protection". It divides the review into three phases: selection, setup and use. The following checklist summarises the most important points for day-to-day work in mid-sized companies.
The checklist
- Define the purpose. What exactly is the AI for? "Let's just try it" is not a purpose. A clear purpose decides which data you need in the first place.
- Check for personal data. Does the AI process names, emails, customer data or employee data? Where possible, leave data out or pseudonymise it.
- Clarify the legal basis. Every processing of personal data needs a legal basis under the GDPR, such as a contract or a legitimate interest.
- Check the provider. Where is the data processed, in the EU or in a third country? Is there a data processing agreement under Art. 28 GDPR?
- Rule out training on your data. Many providers use input from free plans for training. Check whether this is excluded in your plan.
- Check whether a DPIA is needed. For profiling or large-scale processing of sensitive data, such as health data, a data protection impact assessment may be mandatory (Art. 35 GDPR).
- No decision without a person. Decisions with legal effect on people, for example on a job application, must not be made by AI alone (Art. 22 GDPR).
- Inform transparently. Describe the use of AI in your privacy policy if personal data is involved.
- Rules and training. Define in an AI policy which tools are allowed and which data does not belong in them. This is closely linked to the AI literacy obligation.
- Document and review. Record why you chose a tool, and check regularly whether that still holds.
What are the most common mistakes?
- Contracts, customer lists or HR documents end up in a free public chatbot.
- Individual employees use their own accounts that nobody in the company knows about.
- There is no data processing agreement with the AI provider.
- AI results are passed on to customers without being checked.
The simplest route: do not hand the data over in the first place
Many points on the list become easier when the AI runs on your own server or in a data center in Germany. Then the data never leaves your company and there is no third-country transfer. When that pays off is described in Local AI instead of the cloud.
This article is not legal advice. For your specific case, contact your data protection officer or legal advisor.
Sources
- Datenschutzkonferenz: press release on the guidance "AI and data protection" (6 May 2024, German)
- IHK Hannover: Using AI in line with data protection (German)
- Haufe: DSK guidance: AI and data protection (German)
- LfDI Baden-Württemberg: ONKIDA navigation aid (German)
- Bitkom: For the first time, most companies use AI (14 September 2026, German)
