# Is it safe to use AI writing tools with client data under GDPR?

Source: https://digicruncher.com/topic/is-it-safe-to-use-ai-writing-tools-with-client-data-under-gdpr/
Site: DigiCruncher, category Privacy and data in AI tools
Published: 2026-10-26. Updated: 2026-10-26. Replies: 0.

## Question by Lars E., 2026-10-26

My reading after going through the vendor documents: it can be done, but not on a personal free account and not by default. You need a business plan or API terms, a data processing agreement signed, a clear idea of what you are sending, and a decision about whether names need to go in at all. "Safe" is not a property of the tool. It is the combination of plan, contract and what you paste.

The situation. I am a data engineer, and a client wants support tickets summarized and replies drafted with an AI assistant. The tickets contain names, email addresses and sometimes order details. I am the processor side of this job, the client is the controller, and I would like the setup to survive a question from their data protection officer.

What I found so far, none of it legal advice:

- OpenAI's [enterprise privacy page](https://openai.com/enterprise-privacy/) says business data from its Business, Enterprise and API products is not used for training by default, and that it can execute a data processing addendum for GDPR purposes. API inputs and outputs may be retained for up to 30 days to provide the service and detect abuse, with zero retention available for eligible endpoints on request.
- The European Data Protection Board published [Opinion 28/2024](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en) on personal data in AI models, which is mostly about model development, not about my narrower question.

What I still do not know: whether pseudonymizing the tickets before sending is enough to take the content out of scope, where the subprocessors sit, and whether "30 days" counts as a transfer or retention problem the client has to document. I would like to hear how others have handled the paperwork, not just the settings.

---
Cite as: DigiCruncher, "Is it safe to use AI writing tools with client data under GDPR?", https://digicruncher.com/topic/is-it-safe-to-use-ai-writing-tools-with-client-data-under-gdpr/, accessed 2026-10-27.