Skip to content
d.uhlmann (home)Nederlands
Back to Blueprints
Compliance5 min read

The Hidden GDPR Problem in Enterprise AI That Everyone Misses

Why processing personal data through internal AI systems needs purpose compatibility, a valid lawful basis under Art. 6 GDPR, and a DPIA under Art. 35 before processing starts.

Flat illustration of a GDPR screen surrounded by data protection icons
Table of Contents

AI is everywhere these days: inside CRMs, ERP systems, and many other tools. Companies are rapidly integrating AI into as many workflows as possible. Many of those processes involve personal data, sometimes without a clearly established lawful basis, which can create significant GDPR exposure.

Recent enforcement actions by the Dutch Data Protection Authority, including high-profile AI-related GDPR cases, should be a warning sign that organizations cannot ignore this topic. They need stronger governance around AI, data residency, and the lawful processing of data.

The Current Situation

In many corporate environments, AI capabilities are rapidly becoming embedded in daily operations: AI assistants, AI-enhanced CRM systems that process the data stored in them, MCP servers for ERP systems, AI email summarization, and chatbots in customer service.

These systems process employee data, customer data, behavioral data, emails, chat histories, documents, and CRM records. Yet in many cases, organizations have not assessed whether a Data Protection Impact Assessment (DPIA) is needed before introducing them. AI processing is often treated as just another software feature, while legally it may constitute large-scale processing of personal data.

AI is, and will remain, a major disruptive force that can significantly boost productivity. We should all move forward with it. But we need to pay attention to the legal landscape we operate in.

The GDPR Problem

To process personal data in the EU, an organization needs a lawful basis, as set out in Article 6 GDPR. A core principle is that processing is purpose-bound. For consent, Art. 6(1)(a) (read together with Art. 5(1)(b), Art. 4(11), and Recital 32) is clear:

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

In other words, a person allowed you to use their data for a specific purpose. Take a classic B2B service firm. It may have a lawful basis to process employee data for payroll, pension administration, and other employment-related tasks. But employees may not reasonably expect their data to be processed by internal AI systems unless this was transparently communicated and is supported by a valid lawful basis, even when the data never leaves your own IT infrastructure.

This is the core problem many organizations miss. Even if the data is not used for AI training, AI processing is not the purpose the person originally handed it over for. Organizations enter legally questionable territory if they cannot demonstrate purpose compatibility, transparency, and a valid lawful basis for the AI-related processing.

Organizations can try to rely on “legitimate interest” under Art. 6(1)(f), but justifying the processing of employee data through internal AI systems on that basis can be difficult in certain scenarios. It is not impossible, but it requires proper justification by legal and compliance experts.

Other areas need attention as well:

  • Cross-border data transfers, including implications of the US CLOUD Act when relying on US-based cloud providers.
  • Vendor dependencies and what your AI vendors do with the data.
  • Shadow AI: recent examples include universities and municipalities pasting personal data into ChatGPT.

In many organizations, AI adoption is currently outpacing compliance maturity.

What Organizations Should Actually Do

First, understand what you are dealing with. AI is new for most organizations, so develop and follow a policy on whether, how, when, and by whom the technology may be used. In parallel, the EU AI Act makes AI governance, inventory management, and risk classification increasingly relevant.

Once an AI policy is documented and operationally implemented, Article 35 GDPR comes into play with its Data Protection Impact Assessment. Four words in Article 35(1) are crucial: “prior to the processing”.

Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

Before high-risk AI processing of personal data starts, organizations should assess whether a DPIA is required and, where it is, complete it before processing begins. Skipping this can significantly weaken an organization’s position during audits or regulatory investigations. Without going too deep into the GDPR weeds: do these checks before you use personal data with AI, even if the AI only consumes the data and everything stays inside your tenant.

As concrete next steps, I recommend that companies work through four areas:

  1. Governance
  2. GDPR and AI Act compliance
  3. Technical implementation
  4. Organizational measures and impact

Conclusion

When AI adoption outpaces governance and compliance, organizations risk significant fines and reputational damage. Few want to become the next public example in a major GDPR enforcement case.

Many organizations focus heavily on the productivity gains AI can generate (or that they hope it will generate), while underestimating, or misunderstanding, the legal implications of processing personal data with these systems. Under the GDPR and the AI Act in particular, “we don’t train the model” does not automatically make AI usage compliant. This is a common misunderstanding that deserves careful reassessment.

The key challenge for the coming years is not whether or how fast organizations adopt AI, but whether they can operationalize it in a responsible, legally compliant, and secure way (AI Act, NIS2, the Product Liability Directive, and more). Organizations that build strong governance, perform proper DPIAs before processing starts, and understand the legal implications early will gain a significant advantage over those that treat compliance as an afterthought.

The challenge is no longer whether organizations will adopt AI. The challenge is whether they can adopt it responsibly.

This post reflects the personal opinion of the author and does not constitute legal advice. Organizations should consult qualified legal and compliance professionals regarding their specific situation.