The GDPR asks for proof, and AI use is where the proof runs out.
Under Article 5(2) the controller must be able to demonstrate compliance with the data protection principles, and under Article 30(4) the record of processing goes to the supervisory authority on request. Most organizations can produce that for their databases and their SaaS contracts. Few can produce it for AI: the chatbot an employee signed into with a personal account, the personal data inside a prompt or a screenshot, the agent with standing access to mail, files and a CRM. Each of those is processing of personal data. The articles below are the ones that apply first, with the control and the record AccuroAI contributes to each.
The obligations that touch security and IT.
Principles and accountability
Personal data must be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurate, kept no longer than needed and kept secure. Under Art. 5(2) the controller must be able to demonstrate all of it.
Lawful basis
Processing is lawful only if at least one of six grounds applies: consent, a contract with the person, a legal obligation, vital interests, a public task, or legitimate interests that the person's rights do not override.
Automated decisions
People have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects. The exceptions are a contract, authorization by law and explicit consent, with safeguards such as human intervention.
Processors and contracts
Use only processors that give sufficient guarantees. Processing must be governed by a written contract that binds the processor to act only on documented instructions, and a processor may not engage another without the controller's prior written authorization.
Records of processing
Keep a record of processing activities: purposes, categories of data subjects and personal data, recipients including those in third countries, transfers and, where possible, erasure time limits and security measures. The authority can ask for it.
Security of processing
Implement technical and organizational measures appropriate to the risk, such as pseudonymization and encryption, and test them regularly. Art. 32(4) adds steps to ensure staff with access to personal data process it only on the controller's instructions.
Breach notification
Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people. Inform the people affected when the risk is high. Document every breach.
Data protection impact assessment
Before processing that is likely to result in a high risk, in particular with new technologies, assess its impact. A DPIA is required for systematic and extensive automated evaluation of people that drives significant decisions, and is reviewed at least when the risk changes.
International transfers
Personal data may go to a third country only under the conditions of Chapter V: a Commission adequacy decision (Art. 45) or appropriate safeguards such as standard data protection clauses or binding corporate rules (Art. 46), with derogations for specific situations in Art. 49.
Each requirement, one control, one piece of evidence.
General information about the public text of the framework, not legal advice. Mappings describe how AccuroAI controls support each obligation; scope and conformity decisions remain with your legal, compliance and certification partners.
The products behind the evidence.
- GDPR and Enterprise AI: What You Must Show for Shadow AI, Prompts and Agents
- Microsoft 365 Copilot Under GDPR: What the Dutch Assessments Found
- EU AI Act Enforcement Tracker: Every Action Since August 2, 2026
- UK AI Governance After the Data (Use and Access) Act 2025
- Italy's AI Law: Courts Can Now Order Your AI Act Logs as Evidence
What teams ask about GDPR.
Does the GDPR apply when employees use ChatGPT or Copilot at work?
Yes, whenever a prompt, file or screenshot contains personal data. That is processing, so it needs a lawful basis under Article 6, a written Article 28 contract where the provider acts as your processor, and an entry in your Article 30 record. An approved tool can meet those. A tool nobody knows about cannot.
Is pasting personal data into an unapproved chatbot a data breach?
It can be. The Dutch data protection authority said in August 2024 that when employees enter personal data into a chatbot against their employer's agreements, there is a data breach. Article 33 then requires notification unless the breach is unlikely to result in a risk to people, and every breach must be documented either way.
Does AccuroAI make us GDPR compliant?
No. No product does. AccuroAI finds the AI tools in use, redacts or blocks personal data in line, and keeps the logs behind several of the articles on this page. The lawful basis, the processor contracts, the DPIA, the Article 22 assessment and any decision to notify a breach remain yours and your DPO's.
What about Norway, Switzerland and the UK?
Norway applies the GDPR through the EEA Agreement and its Personal Data Act. Switzerland is outside the GDPR and has its own law, the Federal Act on Data Protection (FADP), in force since September 1, 2023. The UK has the UK GDPR, where Articles 22A to 22D replaced Article 22 from February 5, 2026, overseen by the Information Commission (still branded ICO).
Does the Digital Omnibus change the GDPR?
Not as of November 13, 2026. The Commission's Digital Omnibus, COM(2025) 837, proposes amendments to the GDPR, but it is a proposal: the European Parliament's Legislative Observatory lists it as awaiting committee decision. The Digital Omnibus on AI, Regulation (EU) 2026/1744, is law, and it amends the AI Act, not the GDPR.
Is this legal advice?
No. This page summarizes the public text of Regulation (EU) 2016/679, checked against EUR-Lex on November 13, 2026, and describes how AccuroAI controls support the obligations. Confirm your obligations with your DPO or counsel.