Using ChatGPT and other AI tools requires careful vendor checks by SMEs before personal data is entered into prompts, uploaded as documents or shared through connected business systems.
For many small and medium-sized enterprises (SMEs), third-party AI tools offer an immediate productivity gain. Staff can summarise customer correspondence, analyse documents or draft marketing material without building a system themselves. But using a familiar tool does not remove the organisation’s responsibility for the information it shares. A personal-data risk can arise with the first prompt, before a formal procurement decision has even been made.
The practical question is not simply whether a tool is “safe”. It is what information the business will provide, what the vendor is permitted to do with it, and whether the service terms and controls match the intended use. The answers may differ between a free consumer account, a business subscription and an integrated enterprise product.
Personal data in prompts and uploads remains subject to the GDPR.
A prompt may contain a customer name, an employee record, a complaint, a medical detail or a confidential contract. Uploading that information to an AI service is a processing activity, even when the employee’s immediate aim is only to produce a summary. The organisation should be able to identify a lawful basis, a defined purpose and a reason why the particular data are necessary for the task.
Where possible, staff should remove identifiers or use synthetic information. Pseudonymisation may reduce risk, but it does not automatically take information outside the GDPR. Before approving a use case, SMEs should consider whether individuals have received appropriate information, whether the new use is compatible with the original purpose and whether the tool is suitable for special-category or other sensitive data. A data protection impact assessment may be required where the proposed processing is likely to create a high risk to individuals.
A vendor’s treatment of inputs and outputs is central to due diligence.
The most important questions concern the data flow after a user presses “send”. The business needs to understand whether prompts, uploaded files and generated outputs are retained; who can access them; whether they are used to improve a model or service; and whether any such use can be disabled. Marketing assurances are not a substitute for checking the terms and settings that apply to the actual product and subscription.
The European Data Protection Board (EDPB) has examined the development and deployment of AI models under the GDPR, including lawful basis and the limits of claims that a model is anonymous. Its opinion reinforces why businesses should not assume that personal data cease to matter once they have entered an AI system. Due diligence should also cover deletion arrangements and what happens to data when the contract ends.
GDPR roles and contractual terms should reflect what the provider really does.
A vendor is not automatically a processor merely because it supplies a tool. The GDPR role depends on who determines the purposes and essential means of each processing activity. A provider may process customer content on the SME’s instructions for one purpose while deciding its own purposes for another. SMEs should therefore examine the service description and terms rather than rely on a generic “processor” label.
Where the provider acts as a processor, an Article 28 agreement should cover documented instructions, confidentiality, security, subprocessors, assistance with individual rights and incidents, deletion or return of data, and information needed to demonstrate compliance. If the vendor proposes independent uses of submitted data, the SME should understand the legal implications before approving the tool. The EDPB’s small-business guidance explains that choosing an appropriate processor and putting the relationship in writing remain controller responsibilities.
Security, subcontractors and transfers need evidence rather than assumptions.
AI tools can connect to email, file storage, customer databases and collaboration platforms. Such integrations can give a supplier access to far more information than an isolated prompt would reveal. An SME should check access controls, encryption, logging, segregation between customers, incident notification and whether administrators can restrict what users upload or connect.
It should also know which subprocessors support the service and where personal data may be accessed or stored. A transfer outside the European Economic Area needs an appropriate GDPR transfer mechanism and, where required, an assessment of the protection available in practice. A data-residency setting alone may not answer every access or onward-transfer question.
The AI Act and the GDPR ask different questions about the same tool.
The AI Act distinguishes between providers and deployers of AI systems, while the GDPR uses controller and processor roles for personal-data processing. These categories should not be treated as interchangeable. An SME may be a deployer under the AI Act and a controller under the GDPR when it uses a third-party tool in its own operations.
The intended use also matters. An assistant used to polish internal copy raises different issues from a system used to screen applicants or support decisions about workers or customers. Before adopting a tool for a consequential purpose, the business should check whether additional AI Act requirements, transparency duties or human-oversight arrangements apply, alongside its GDPR assessment.
A proportionate approval process can keep AI adoption manageable.
Smaller organisations do not need an elaborate procurement bureaucracy for every low-risk experiment. They do need a reliable point at which a tool’s purpose, data inputs, vendor terms and potential effect on people are reviewed. Approval can be conditional: a tool may be permitted for drafting with non-personal information but not for uploading client files or making decisions about individuals.
The review should be revisited when the vendor changes its terms, introduces new model features, adds integrations or changes the data it retains. Clear ownership between the business user, procurement, IT and the DPO or privacy lead helps ensure that a convenient tool does not become an unmanaged data channel. This connects naturally with the AI inventory and staff guidance covered earlier in the series, while making supplier accountability the focus here.
Discover how Aphaia helps organisations assess third-party AI tools and their data protection risks.
Aphaia helps organisations examine AI use cases, assess vendors and contractual arrangements, and integrate AI procurement into practical GDPR and AI governance processes. Proportionate checks can give SMEs the confidence to use helpful tools while retaining control over personal data and accountability for their decisions.
