Advanced · Team and organisation · module 117 of 155
Personal data and AI: applying the GDPR
Apply the basic principles of the GDPR when you want to process personal data with AI.
After this lesson
You check whether an AI application processes personal data, assess purpose, legal basis and minimal data, and know which agreements with a provider are needed.
In view · Step by step
Personal data with AI, step by step
Record what you use the data for and on what basis.
Only use data the task really needs; take care with sensitive data.
A data processing agreement with the provider and clear information for the people concerned.
Part 1 of 3 · Purpose and legal basis
Your preference for less movement is on. Choose each part yourself.
When the GDPR comes into play
The General Data Protection Regulation (GDPR) applies as soon as you process personal data: data about an identifiable person, such as a name, email address, customer number or a description from which someone can be identified (lessons 5 and 23). A prompt with a customer question, an uploaded CV or a recorded meeting can therefore fall under the GDPR. Stricter rules apply to special categories of data, such as health, religion or ethnic origin. In Belgium, the Data Protection Authority is the supervisory authority.
Purpose, legal basis and as little data as possible
Decide in advance what you will use the data for and whether that fits the purpose for which it was collected. You need a legal basis, for example a contract, a legal obligation or a legitimate interest. Do not use more data than necessary: a general description without a name is often enough. Inform the people concerned and respect their rights, such as access and erasure. If processing is likely to result in a high risk for people, a data protection impact assessment is needed beforehand.
Agreements with the provider
If an external AI service processes personal data for your organisation, that service is usually a processor. This requires a processor agreement, with arrangements on security, retention periods and what the service may do with your data, for example whether it is used to train models. Also watch out for transfers outside the European Economic Area. So use only tools your organisation has approved, and involve the data protection officer in new applications. This lesson is not legal advice.
New practice example
From explanation to a usable result.
As soon as AI processes personal data, the GDPR applies: a purpose, a legal basis, as little data as possible and agreements with the provider.
Fictional practice situationFictional: a fitness centre wants to use AI to create personal training schedules based on members’ weight, age and injuries.
View a possible solution
This is how it can be done
Injuries are health data and therefore special category personal data, to which stricter rules apply. The centre records the purpose and legal basis, informs members clearly, uses only necessary data and concludes a data processing agreement. It has someone check whether an impact assessment is needed. Until then the team practises with fictional profiles.
Why this works
Health data increases the risk for people. By recognising it first, you know which agreements and checks are needed before you start.
Make it slightly more difficult
Write two sentences for the privacy statement that explain how AI is used in this application. Are they understandable for a member without legal knowledge?
Extra practice, at your own pace. You do not need to submit anything. This does not count towards an automatic assessment.
Your workplace · learning by doing
Make something. See what changes.
Checking the AI connection… You can already view the written example.
Present your assignment to Ende.
Read the answer, change one thing, and compare.
Previously held
New version
You remain in control
What do you want to improve in your next attempt?
On this device only. AI answers remain only in this page memory. This is self-review, not a grade.
Why this approach works
Health data increases the risk for people. By recognising it first, you know which agreements and checks are needed before you start.
A step further
Write two sentences for the privacy statement that explain how AI is used in this application. Are they understandable for a member without legal knowledge?
Try & discover · no obligation
Put the steps in a workable order
Move the steps with the arrows. Check whether each step has its necessary input and control.
What does a step depend on?
- Determine the goal must precede Map the personal data you need
- Determine the goal must precede Inform the people concerned
- Map the personal data you need must precede Check the legal basis
- Map the personal data you need must precede Assess the risk with the data protection officer
- Assess the risk with the data protection officer must precede Arrange agreements with the provider
- Check the legal basis must precede Start with as little data as possible
- Arrange agreements with the provider must precede Start with as little data as possible
- Inform the people concerned must precede Start with as little data as possible
Move a step and then check the sequence. The arrows also work with your keyboard.
This model checks dependencies, not duration, capacity, or actual execution. With multiple agents, the human decision remains a separate step.
This trial works locally with fictitious data and does not count towards your lesson completion. It starts anew with a new lesson or reload.
A prompt to get you started
Help me assess a fictional AI application against the GDPR. Idea: have an external AI service summarise customer questions that come in via a web form, so that a staff member can answer faster. Ask me questions about purpose, legal basis, which data is needed, retention period, agreements with the provider and information for customers. Then make a list of open points for our data protection officer. Do not give a final legal judgement.
Apply it
A colleague wants to have recorded customer calls transcribed and summarised by a new AI service. There is no data processing agreement and customers do not know they are being recorded.
Which approach best fits this situation?
- Stop until the purpose, legal basis, information for customers and agreements with the service have been settled, together with the data protection officer.
- Carry on; only staff read the summaries.
- Remove the names from the summary afterwards and carry on.
With JavaScript, you can check your approach and receive immediate feedback.
Test your insight
You want to have job application letters summarised with a free online AI tool, without any agreements with the provider. What is the biggest problem?
- There is no problem as long as the summary is correct.
- You share personal data with a service without a processor agreement and possibly without an appropriate legal basis.
- The only problem is that the summary might be too short.
Extra practice
Choose an AI application from your work that may involve personal data. List purpose, data, legal basis, provider and retention period, and note what you still need to check.
Purpose: answer customer questions faster. Data: the question itself is needed; name and email address are not needed for the summary. Legal basis: performance of the customer relationship, to be confirmed by the data protection officer. Provider: only with a processor agreement and without training on our data. Retention period: delete summaries once handled. Open point: does the privacy statement need to be updated?
