Data protection is usually treated as something to sort out once the AI project works. That order is expensive. Several of these questions can invalidate an approach entirely, and finding that out after building is worse than finding it out in a meeting.
Five questions, each of which should have a documented answer before the first prompt is sent.
1. Is personal data involved at all?
Often assumed to be no, and usually wrong. Personal data is any information relating to an identifiable person — not only names and addresses. A support ticket describing a customer's complaint is personal data. A CV is. An email signature is. A photograph is.
Note also that the question is not only about the documents you intend to process. If employees can paste arbitrary text into an assistant, personal data will enter the system regardless of what you planned.
2. What is your legal basis?
Processing personal data requires a basis under Art. 6 GDPR. For most business use this will be legitimate interest or contractual necessity. It needs to be identified and written down.
A specific trap: if you already hold data collected for one purpose, using it for a new AI-driven purpose may exceed the original basis. Analysing existing customer records to train or drive something new is precisely where this arises.
3. Who is the processor, and is there a contract?
If a provider processes personal data on your behalf, they are your processor and Art. 28 GDPR requires a data processing agreement. This is not optional and it is not satisfied by their terms of service.
The agreement should name sub-processors — every AI provider has at least one, being whoever runs the underlying infrastructure. You should know who they are and how you are told when they change.
4. Where is it processed?
Processing within the EU or EEA is straightforward. Processing in a third country requires a transfer mechanism under Art. 44 and following — an adequacy decision, standard contractual clauses, possibly supplementary measures.
Ask for the specific region, in writing. Also ask whether any ancillary functions — abuse monitoring, for instance — are handled elsewhere, because that detail is frequently where an unexpected transfer hides.
5. What happens to the data afterwards?
Retention, deletion and the training question.
Are your inputs used to train models? Get this as a contractual assurance, covering third-party models as well as the provider's own. How long is data retained, and how long does it persist in backups? On termination, what is the export format, the export window, and the deletion timeline?
The two that get skipped
Your records of processing. Art. 30 requires you to maintain a record of processing activities. A new AI system is a new activity and belongs in it.
Whether an impact assessment is needed. Art. 35 requires a data protection impact assessment where processing is likely to result in high risk — particularly for systematic evaluation of individuals or large-scale processing of sensitive categories. If your AI system evaluates people in any way, this question needs answering rather than assuming.
The practical point
None of this is difficult. Every question above has a short answer available from a competent provider in a single conversation. The cost of asking is an hour. The cost of not asking arrives later, usually when a customer asks you first.
This article is general information, not legal advice. For your specific situation, consult a qualified lawyer.
