What GDPR says, in one sentence
When you put customer, employee or supplier data into a tool, you remain responsible for that data, and the tool's vendor becomes your processor. They must commit in writing not to use it for themselves, to protect it, and to delete it when you ask. Everything else follows from that.
The 5 settings to fix before you start
- 1. Use the business version. ChatGPT Team or Enterprise, Claude Team or Enterprise, Copilot for Microsoft 365, Gemini in Google Workspace. On these plans, the vendor contractually commits not to train its models on your data. On consumer versions, that is not guaranteed by default: check the setting, or put nothing identifiable in it.
- 2. Accept the data processing agreement (DPA). Every serious vendor offers one online, often accepted in one click in the admin settings. It is the document you will be asked for in an audit.
- 3. Choose EU hosting when offered. Several vendors now offer to keep data on European servers. It is not required to be compliant (transfers to the US are regulated), but it simplifies the conversation with a demanding client.
- 4. Add one line to your record of processing activities. "Drafting and document processing assistance, tool X, data: customer identity and contact details, retention: 30 days in the tool." Five minutes.
- 5. Turn off what you do not need. Connectors to your mailbox or drive are handy, but enable them only for the people who use them.
The 3 rules for the team
I prefer three rules on the wall to a policy nobody reads.
- We never paste: health data, card numbers, passwords, data about minors, or a person's complete file. If a task needs them, we anonymize ("the client" instead of the name) or we do not hand it to AI.
- We always proofread: everything that comes out is a draft. Numbers, names, dates and commitments are checked by a human before sending.
- We know who approves: for each task handed to AI, one person is responsible for the result. Never "the AI said so".
What you can hand to AI right now
- Writing quotes, follow-ups, emails and meeting notes from your information (with the client's name, on a business plan).
- Summarizing and reviewing contracts, tenders, internal documents.
- Preparing your content (posts, newsletter, product sheets).
- Matching invoices and statements, filing documents.
What you do not hand over (or not like that)
- Automatic decisions about people: rejecting a candidate, a loan, a refund. AI can prepare, a human decides, and the person has the right to know.
- Health or criminal data, except in a dedicated, regulated tool (some industry software is).
- Conversations with customers who do not know they are talking to an AI. Say it, simply.
The point nobody tells you: you must train your team
The EU AI Act requires, since 2 February 2025, that companies using AI ensure their staff has a sufficient level of "AI literacy" (article 4). No diploma required: half a day of practice with written rules, documented, is enough for a small business. It is one of the goals of my workshop, and I hand you the material that proves it.
In short
The business version of a tool, the DPA accepted, one line in the record, three rules on the wall, half a day of practice. With that, a small business uses AI on its real data while staying compliant, and above all, at ease. This guide is not legal advice: for a specific case (health, finance, minors' data), talk to your lawyer or data protection officer.