ndaact.ai and the GDPR

Last updated : 2026-10-14

The problem GDPR raises for generative AI use

Sending your clients’ personal data to ChatGPT or Claude is a transfer of data to a third party (the model operators). Without a clear legal basis or an up-to-date record of processing activities, this transfer exposes your organization to a risk that is anything but theoretical.

What ndaact.ai technically does

Detection and replacement of personal data with markers runs on your machine. Your prompts and documents do not go through any ndaact.ai server; the text then goes to the LLM provider, with markers in place of the detected entities. An entity that is not detected stays in clear text: ndaact.ai helps protect your data, without guaranteeing that every entity is found.

Records of processing activities (Article 30)

Each detection is logged locally (type of data detected and timestamp, without the original value). This log can feed your records of processing activities under Article 30 of the GDPR: it constitutes a trace of the technical measure taken to limit exposure of personal data before any use of generative AI.

ndaact.ai doesn’t replace your legal-basis analysis for your existing processing activities. What it concretely brings: a data minimisation measure (Article 5(1)(c) GDPR principle) applied specifically to the flow toward third-party LLMs: detected identifying data leaves your workstation only as opaque markers, reducing exposure when using generative AI.

What we don’t claim

  • ndaact.ai covers one specific flow, the use of external LLMs, and nothing else of your GDPR compliance.
  • We don’t claim the tool exempts you from a data protection impact assessment (DPIA) if one is otherwise required for your processing.
  • Protection covers the data the tool actually detects, with no completeness guarantee across every type of content.

For you to judge

Integrating ndaact.ai into your record of processing activities and risk analysis remains a decision for your DPO or advisor, depending on the exact nature of your processing activities.