Is it safe to use AI writing tools with client data under GDPR?
My reading after going through the vendor documents: it can be done, but not on a personal free account and not by default. You need a business plan or API terms, a data processing agreement signed, a clear idea of what you are sending, and a decision about whether names need to go in at all. "Safe" is not a property of the tool. It is the combination of plan, contract and what you paste.
Cite
DigiCruncher, "Is it safe to use AI writing tools with client data under GDPR?", https://digicruncher.com/topic/is-it-safe-to-use-ai-writing-tools-with-client-data-under-gdpr/, accessed 2026-10-27.The situation. I am a data engineer, and a client wants support tickets summarized and replies drafted with an AI assistant. The tickets contain names, email addresses and sometimes order details. I am the processor side of this job, the client is the controller, and I would like the setup to survive a question from their data protection officer.
What I found so far, none of it legal advice:
- OpenAI's enterprise privacy page says business data from its Business, Enterprise and API products is not used for training by default, and that it can execute a data processing addendum for GDPR purposes. API inputs and outputs may be retained for up to 30 days to provide the service and detect abuse, with zero retention available for eligible endpoints on request.
- The European Data Protection Board published Opinion 28/2024 on personal data in AI models, which is mostly about model development, not about my narrower question.
What I still do not know: whether pseudonymizing the tickets before sending is enough to take the content out of scope, where the subprocessors sit, and whether "30 days" counts as a transfer or retention problem the client has to document. I would like to hear how others have handled the paperwork, not just the settings.
Write something first.
Give people something to work with: at least 30 words on what happened and what you tried.
That is too long. Keep it under 6,000 characters.
Write the question as the title, 15 to 140 characters, no links.
Pick a category.
Add a name (2 to 40 characters, no links).
That email address does not look right.
That was quick. Read the thread, then try again.
The form expired. Reload the page and post again.
Something went wrong with the form. Reload and try again.
Please complete the check and post again.
Limit reached for now. Try again later.
This thread is closed to new replies.
This thread no longer accepts replies.
Something went wrong with the form. Reload and try again.
Post a reply or question first (name and email), then this browser can vote, edit and accept answers.
You cannot vote on your own post.
Only the author (within 30 days) or the forum team can do that.
That email already has an account. Use your sign-in link instead.
New accounts are paused for the moment. Try again later.
That was already posted.