GDPR and artificial intelligence: a practical guide for small businesses.
The three questions that matter
- Where is the data processed? On your server, inside the EU, or outside it. Everything else follows from the answer.
- Who is the processor? If an outside provider processes personal data on your behalf, you need a processing agreement under GDPR Article 28.
- Is there an international transfer? Sending data to servers in the US requires additional safeguards — standard clauses, adequacy frameworks — and you want those documented.
The honest shortcut: keep the data in
The simplest route to compliance is structural: if the AI runs on your own infrastructure, there is no outside provider processing personal data, no international transfer, and the processing agreement you have already signed with your clients remains fully valid. That is the thinking behind AUREA's private AI.
Do not forget the backups
GDPR reaches backups too: if they are stored off site, they must be encrypted so that the backup provider cannot read them. We go through it in detail in the encrypted backups guide.
A minimum checklist for your business
- Inventory: which personal data your AI tools touch.
- Location: where each processing activity happens — your server, the EU, or outside it.
- Contracts: a processing agreement with every provider handling data on your behalf.
- Backups: encrypted, with the key under your control.
- Transparency: a privacy policy that reflects these activities.
This article is informative and does not replace professional legal advice for specific cases.
Quick questions
It can be done, but it takes work: international transfer agreements, a review of the provider's terms, and care over which personal data you send. The structural alternative is running the AI on your own server so the data never leaves.
The GDPR Article 28 contract you must sign with any provider that processes personal data on your company's behalf, setting out what they do with it, under what measures, and what happens when the service ends.
