GDPR and AI: the questions to ask your supplier
GDPR does not stop AI. But it does require you to know what happens to the data, and that starts with the right questions to your supplier.
iSearch
Sooner or later, the question comes from the data protection officer. Which personal data ends up in the AI tool, where is it processed and who can see it? Fair questions. GDPR applies in full even when a tool is new and exciting, and the earlier the answers are on the table, the smoother the rollout.
The good news is that the answers do not have to be complicated. With the right solution they are short. A few questions are worth asking every supplier, and a good answer is easy to recognise.
Where the data is processed
This is the question that decides most. When someone asks an AI assistant a question, the question is sent, and excerpts from the documents behind the answer often go with it. If those documents contain personal data, and they almost always do, that data is processed wherever the answer is produced.
If that happens at an external supplier, the supplier becomes a data processor and you need an agreement describing how the data is handled. If it also happens outside the EU, questions about transfers follow. All of that can be solved, but it takes time. The shortest answer is a solution where the whole chain can run in your own environment. Then the data never leaves the organisation.
Close to it sits the question of training. Is your data used to train models? The answer should be a clear no. What you type in should be used to answer your questions and nothing else, neither for you nor for any other customer.
Who sees what
An AI assistant must never become a shortcut around permissions. If someone is not allowed to read a document, the assistant should not be able to repeat it either. It sounds obvious, but it requires the solution to use the same roles as your other systems, rather than its own copy that soon goes out of date.
So ask how sign-in works and whether it uses the accounts people already have. Ask how roles control access and whether sensitive changes need approval from two people. A good answer describes a solution where least privilege applies from the start.
How long everything is kept
GDPR requires that personal data is not kept longer than necessary. That includes the questions, answers and logs an AI assistant creates. A good solution lets you set retention per type of data, so history is cleared when it is no longer needed.
Finally, there are data subjects’ rights. When someone asks for their data, or wants it erased, it should be possible to do that for a single user without a project of its own. Ask how export and erasure work in practice. Ask too what happens when data must be kept longer than usual, ahead of a dispute for example, and whether legal hold is supported. A reassuring answer shows that the supplier has thought about the whole lifecycle, from day one to exit.
How it works in iSearch
The whole chain in iSearch can run in your own environment, the language model included. Personal data then never leaves the organisation. If you would rather we run it, you get a separate installation of your own and a data processing agreement.
Sign-in uses SSO and MFA, and role-based access and the four-eyes principle control who sees and changes what. Retention is set per type of data, data can be exported and erased per user and legal hold is included. Your data is never used to train models.
Read more about security, our privacy policy or book a walkthrough.
Want to see how it would work for you?
We’ll show you iSearch with your own documents.