AI and GDPR: What Can SMEs Do with Customer Data and AI?

You may use customer data for AI if you have a valid GDPR (AVG) legal basis and make agreements with the supplier of the AI tool. As soon as you enter customer details into an AI tool, you're processing personal data in the sense of the GDPR. This article explains which rules then apply to SMEs, what a data processing agreement is and how to start safely.

Why do AI and the GDPR matter for SMEs now?

More and more SMEs use AI: a chatbot that answers customer questions, software that sorts email, a tool that analyses customer profiles. As soon as you enter customer details into such tools, you're processing data.

The AVG (Algemene verordening gegevensbescherming) is the Dutch name for the European GDPR. The law applies to every company that processes personal data of people in the EU. Personal data is broader than you think: a name, email address, phone number or customer number already counts.

The European AI Act also brings obligations, including on transparency when AI affects customers directly. So it's wise to get your AI use in order now.

Which customer data may you use for AI?

The GDPR doesn't forbid using customer data for AI, but it sets conditions. You need a valid legal basis for processing. The three most relevant for SMEs:

1. The customer's consent

The customer gives explicit consent for the use of their data. Pre-ticked boxes don't count: consent must be freely given, specific and unambiguous. For AI uses this is the hardest basis, because customers have to understand what they're consenting to.

2. Performing a contract

You use the data to deliver a service the customer asked for. A transport company that uses AI to work out the best delivery route from customer addresses may use those addresses. It's part of the agreed service.

3. Legitimate interest

You have a legitimate business interest in the processing and that interest outweighs the customer's privacy interest. This is a commonly used basis for analysis and marketing, but also the riskiest. Always record why the interest is legitimate.

What isn't allowed just like that?

Special categories of personal data (health, religious belief, race, political opinions) may in principle not be processed, not even for AI. A medical practice that wants to train an AI on patient files, or an employer that uses AI to predict sick leave from medical background: that's only possible with explicit consent or another statutory exception, and with extra safeguards.

What is a data processing agreement for AI services?

Do you use an external AI tool, such as ChatGPT (OpenAI), Claude (Anthropic) or Azure AI (Microsoft)? Then you're sending customer data to the servers of a third party. That party is a processor under the GDPR and you remain the controller. So the responsibility stays with you.

You must sign a data processing agreement (DPA) with every AI supplier that processes customer data for you. Among other things, it states:

• which personal data is processed
• what that data is used for, and whether it's also used for model training
• how long the data is kept
• which security measures apply
• whether data is stored outside the EU, and on what basis

How does it work with the big AI providers?

• OpenAI (ChatGPT): with the business API and business subscriptions you can sign a DPA and your data isn't used for training. The free consumer version doesn't have that protection. Never enter customer data there.
• Anthropic (Claude): offers a DPA through the API. Check your account settings on the use of data for training.
• Microsoft Azure AI: has extensive GDPR compliance, including the option of storage in the EU. Often a suitable choice for SMEs with strict privacy requirements.

Practical rule of thumb: for customer-sensitive data always use a business subscription or a business API, never a free consumer version. You can read more about choosing a subscription in ChatGPT for business: privacy, GDPR and safe use.

Which GDPR checklist do you use for AI in SMEs?

About to start with AI and customer data? Go through these points:

• Legal basis recorded: on which GDPR basis do you process the data?
• Data processing agreement: do you have a DPA with your AI supplier?
• Privacy statement updated: does it say that you use AI?
• Data minimisation: do you use only the data that's really needed?
• Retention policy: do you know how long data is kept and can you have it deleted?
• Employees informed: do they know which customer data they may and may not enter into AI tools?
• Processing register: is the AI use in it?

Appointing a data protection officer (functionaris gegevensbescherming, FG) can also be mandatory. That doesn't depend on the number of employees, but on what you do: for example if you process sensitive data on a large scale or systematically monitor people on a large scale.

What do you do if you're unsure whether something is allowed?

Not sure whether you may use certain customer data for an AI project? Go through these steps.

Step 1: Minimise the data

The less personal data, the less risk. Anonymise or pseudonymise where you can. If a customer ID is enough, don't use a name and email address.

Step 2: Check your DPA

Does your AI supplier have a valid data processing agreement? If not, stop or switch to a supplier that offers one. Without a DPA you're breaking the GDPR.

Step 3: Consult the Dutch Data Protection Authority

The Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) publishes guidelines on AI and privacy. For specific situations you can also request a prior consultation.

Step 4: Consider a DPIA

A Data Protection Impact Assessment (DPIA) is mandatory if you build customer profiles on a large scale or process sensitive data. Even when in doubt a DPIA is useful: you put the risks and measures on paper.

Step 5: Get advice

A GDPR adviser or lawyer who knows AI costs a few hours and is cheaper than a fine. The Autoriteit Persoonsgegevens can impose fines of up to 4% of worldwide annual turnover (or 20 million euros, if that's more).

Want to use AI on your own company data and get the basics in order first? Take a look at data in order, or read about liability for AI agents and customer data. Prefer to talk to someone? Book an intro call.

Frequently asked questions

May I use customer data to train an AI?

Yes, but only with a valid GDPR legal basis (consent, a contract or legitimate interest) and a data processing agreement with the AI supplier. Special categories such as health data are extra protected.

Do I have to tell my customers that I use AI?

Yes. Your privacy statement must say how you process personal data, including the use of AI in that. If AI decisions have legal effects for customers, such as a credit assessment, they have a right to human intervention.

Is ChatGPT GDPR-compliant?

Through the business API or a business subscription, with a DPA, it can be. Through the free consumer version it can't. Don't enter customer data there.

What exactly is a data processing agreement?

A contract with your AI supplier that sets down how they may use, secure and store your customer data. Without this agreement you're breaking the GDPR, even if the supplier is GDPR-compliant itself.

How do I know whether my AI supplier stores data outside the EU?

Check your supplier's DPA and privacy statement and ask before you start. Many providers offer EU storage for business customers, but it isn't the default everywhere.

Sources

• General Data Protection Regulation (GDPR), EUR-Lex
• Rules for using AI & algorithms, Dutch Data Protection Authority
• Enterprise privacy at OpenAI, OpenAI