AI and GDPR: what it really involves
“I want to use AI, but I have to protect the data. Concretely?”
The observation
"We are GDPR compliant" means nothing on its own. The question isn't whether you are on paper, but whether you know where your data goes, who accesses it, how long it is kept, and what you can prove. It's as much an architecture topic as a documents topic.
How we handle this topic
Where your data goes — and where it doesn't
Depending on the level chosen (private cloud, self-hosted model on your servers), we document the flow precisely. When self-hosted, no data passes through a third party.
Minimization by design
We only process what the service needs. No collection just in case.
Defined retention periods
Activity logs and conversations have a lifespan decided with you, and applied automatically.
The case of employee data
Behavioral analysis and HR tools touch sensitive data. The framework (purpose, informing individuals, duration) is defined before deployment, not after.
What it changes for you
- You know how to answer a client or an inspection: here's where the data goes
- Retention periods are applied, not declared
- Sensitive data (employees, health, legal) is handled under a dedicated framework
The limit, stated plainly: We help you document and architect. Effective compliance is established by you or by an auditor: we provide the elements, we don't certify.
Is your situation specific?
This topic is handled case by case. The assessment frames it around your numbers, not in the abstract.