GDPR for AI systems: DPIA, data minimisation and data subject rights in your AI products
We map which personal data flows through your AI product and build protection into it: masking, retention periods and deletion on request. We prepare the technical part of the DPIA for your DPO.
What hurts
Your voice bot records calls, your chatbot stores phone numbers and call analytics sends transcripts to a model. Nobody can say where this data sits or for how long.
An EU customer asks you to erase their data. You delete it from the CRM, but copies remain in model logs, the vector database and transcripts.
A European partner asks for a DPIA and a subprocessor list before signing. Your lawyer is ready to help but has no technical facts.
What we build
- A personal data map: where data comes from, where it goes and where it is stored
- A list of subprocessors and model providers with processing locations
- The technical part of the DPIA for your DPO or counsel
- Masking of personal data before it reaches the model
- Retention periods for recordings, transcripts and logs with automatic deletion
- Erasure on data subject request across all stores, including the vector database
- User notices about AI processing of their data
What you get
- A map of personal data flows in your AI product
- The DPIA technical section and a subprocessor list
- Masking, retention and erasure built into the code
- A procedure for handling data subject requests
- Vendor DPA templates for your counsel to review
How we measure the result
- Time to complete an erasure request
- Share of data stores with a retention period configured
- Number of subprocessors with a signed DPA
- Number of personal fields reaching the model unmasked
Systems and stack
Industries
Questions
Do you replace our DPO or lawyer?
No. We prepare the technical facts and build protection into the product. The lawfulness assessment, legal bases and the final DPIA text are approved by your DPO or counsel. We work together so the documents match what the system really does.
How much does it cost and how long does it take?
From $5,000 over 3–6 weeks. The price depends on the number of AI services, data stores and vendors. It takes more work when data is spread across several systems with no single customer identifier.
Can we use OpenAI or Gemini under GDPR?
Often yes, with conditions: a DPA with the provider, a suitable processing region, training on your data switched off and minimisation of what is sent. For sensitive data such as health records, a private model on vLLM in your perimeter is the safer option.
What do you need from us?
Access to the code and architecture of the AI product, a vendor list, existing privacy policies and your DPO contact. We sign an NDA and DPA before access. We operate under ISO/IEC 27001:2022.
Does this also cover the EU AI Act?
Partly. Data governance, logging and transparency overlap between GDPR and the EU AI Act. But the AI Act adds its own requirements on risk classification and documentation. We cover those in a separate readiness project if you need it.
What happens after implementation?
Every new vendor or use case changes the data map. We can keep it current under an SLA or train your team. The erasure and masking mechanisms stay in your code.
Related services
More in this section
Describe the task. We reply within one business day, the first call is with the founder.
Describe the task. The first call is with the founder.
We reply within one business day. 30 minutes to tell you whether it is worth doing and what it costs.