AI and the GDPR: what organisations need to know

When does the GDPR apply to AI?

As soon as an AI processes personal data: in the input, in uploaded documents, in the answer or already at sign-in. This is almost always the case with draft letters, administrative decisions, minutes or emails. Only uses with no personal reference at all, such as the analysis of geological maps, fall outside it. The German Data Protection Conference (DSK, the joint body of the German data protection authorities) advises checking this thoroughly and over the entire life cycle of the data, because personal reference can also arise from the context.

What are your obligations as controller?

Obligation	Basis	What this means for AI
Define the purpose	Art. 5(1)(b)	Determine areas of use in advance; public bodies within the scope of their tasks
Legal basis	Art. 6, for health data Art. 9	for every processing step, including transfer to the provider
Inform	Art. 13, 14	Data subjects learn that and how AI is used
Contract with the provider	Art. 28	DPA with binding instructions, sub-processors, deletion
Records	Art. 30	Enter the use of AI as a separate processing activity
Security	Art. 25, 32	Permissions, logs, encryption, privacy-friendly default settings
Impact assessment	Art. 35	“often” required for AI (DSK), as a rule for health data
Data breaches	Art. 33, 34	Notification to the supervisory authority within 72 hours

Involve your data protection officer early. The same goes for the works council or staff council: introducing AI often triggers co-determination rights.

Is the AI provider a processor?

Usually, yes. If you use a provider’s AI for your purposes, the provider acts on your behalf, and you conclude a contract under Art. 28(3) GDPR. It is different if the provider uses your inputs for its own purposes, for example to train its models. For that part, it becomes a controller itself (Art. 28(10)) and needs its own legal basis. The DSK therefore considers applications preferable that do not use inputs and outputs for training. What to look for in the contract: Data processing agreements with AI providers.

What applies to health, social and citizen data?

Health data belongs to the special categories under Art. 9 GDPR. Processing it is prohibited unless an exception applies; in healthcare this is usually Art. 9(2)(h) together with the treatment contract and a duty of confidentiality. Specific German laws come on top: § 203 StGB (Criminal Code) for professional secrecy holders, § 393 SGB V (Social Code, Book V) for cloud services in healthcare, social secrecy and § 80 SGB X for social data.

May an AI make decisions about people?

Not on its own, in principle. Under Art. 22 GDPR, decisions with legal effect may not be based solely on automated processing. The DSK requires that the human making the decision has genuine discretion; merely formal involvement is not enough. Its example: an AI that evaluates applications and sends out invitations itself infringes Art. 22. For public authorities in Germany, § 35a VwVfG (Administrative Procedure Act) governs fully automated administrative acts, and these are ruled out where discretion is involved.

What about transfers to the USA?

If the AI model runs at a US provider, or such a provider has technical access, this is a transfer to a third country (Chapter V GDPR). For certified companies, the adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 applies; the General Court of the EU dismissed an action against it in September 2025, but the litigation may continue. Irrespective of this, the US CLOUD Act applies to US companies, including in European data centres. What role this plays in your risk assessment is explained in US CLOUD Act and AI.

And the AI Act?

It applies in addition. For most assistants in public administration and hospitals, the obligations remain manageable: AI literacy of staff (Art. 4) and transparency (Art. 50). It becomes stricter for high-risk systems. With amending Regulation (EU) 2026/1744, in force since 27 July 2026, their obligations apply to systems under Annex III only from 2 December 2027, and to products under Annex I from 2 August 2028. Overview: AI literacy under Art. 4.

Checklist before you start

• Purpose: Define areas of use in writing.
• Location: Where do the platform and the AI model run, and who has access?
• Training: Excluded by contract?
• Contract: DPA, list of sub-processors, if needed an agreement under § 203 StGB.
• Documentation: Records, DPIA, information for data subjects.
• Rules: Service instruction or works agreement, work accounts, training.

How does this work with basebox?

basebox acts as a processor: the DPA under Art. 28 GDPR is part of every contract, and the TOMs and the list of sub-processors can be downloaded on /sicherheit. Your data does not train any model. The AI model in basebox runs on your hardware with the server, and in Germany with the cloud. For the records and the DPIA there are templates in which the details on basebox are already filled in. People make the decisions: basebox makes suggestions.

Not legal advice: This overview does not replace a case-by-case review by your data protection officer. Guidelines from the supervisory authorities and the AI Act are continually updated. Research as of: 11 October 2026.