GDPR and AI: which personal data leaves in your prompts
Last updated : 2026-11-04
As soon as a text sent to an AI contains personal data, the GDPR applies and the organisation that decides to send the text and sets its purpose generally remains the controller; this guide lists the points to examine and shows where ndaact.ai helps.
What actually leaves in a prompt
A prompt (the text you paste or type into an assistant) often contains more than the question. A letter to summarise, a file to analyse or an email to rephrase sends the model provider the names, contact details and identifiers of the people mentioned. A name in a text is personal data; sending it to a provider is processing.
Points to examine
The table lists the GDPR articles that come up most often for the use of an AI assistant. Each row says what ndaact.ai can help with and what remains your responsibility.
| Point to examine | What the GDPR says | What remains your responsibility | What ndaact.ai can help with |
|---|---|---|---|
| Data minimisation | Data must be limited to what is necessary (Art. 5(1)(c)) | Decide which data is necessary for the purpose | Replace detected entities with markers before sending |
| Data protection by design | Plan appropriate technical measures from the start (Art. 25) | Choose and document the measures | Provide a local technical measure, on your PC |
| The AI provider | A contract governs the processor (Art. 28) | Review the contract and your account settings | Nothing: this depends on your provider |
| Transfers outside the EU | Transfers to a third country are regulated (Art. 44 to 46) | Check where the provider processes the data | Reduce the identifying data that leaves, without removing the transfer |
| Security | Appropriate technical and organisational measures (Art. 32) | Assess the risk level of your activity | Local pseudonymisation with an encrypted correspondence table on your PC |
| Record of processing | Keep a record of processing activities (Art. 30). Organisations with fewer than 250 employees are exempt, unless the processing is likely to result in a risk, is not occasional, or involves sensitive data (Art. 30(5)) | Write and maintain the record | Provide a template line: see the guide on the record |
| Impact assessment | Required, before the processing starts, when it is likely to result in a high risk (Art. 35) | Decide whether one is needed and carry it out | Nothing: the decision is yours |
Pseudonymising before sending: what it changes
The GDPR defines pseudonymisation in Article 4(5): processing such that the data can no longer be attributed to a specific person without additional information, kept separately. ndaact.ai applies this idea before sending: detected entities are replaced by markers, and the correspondence stays on your PC. The model provider receives the text with markers in place of the detected entities.
For the difference with anonymisation and the state of European case law, see the guide on definitions and the guide on judgment C-413/23 P. Pseudonymised data remains, in principle, personal data: the GDPR continues to apply.
Limits to know
- Only detected entities are replaced. An entity that is not detected goes out in the clear: read the text before sending when the stakes are high.
- ndaact.ai does not assess your legal basis, your contract with the provider, or whether an impact assessment is needed.
- A text can identify a person without naming them (a rare situation, a specific context). No detection tool covers this case reliably.
- The compliance of a use depends on the whole: purpose, legal basis, contract, information to individuals, security. The technical measure is only one part.
Before you start
- Write the purpose of your AI use in one sentence.
- Go through the table above and note, for each row, who decides in your organisation.
- Add the use to your record, with the template from the dedicated guide.
- Have your DPO or an adviser review it, in particular transfers and the impact assessment.