Pasting personal data into an AI tool is processing by a new recipient, usually involving an international transfer, and needs a lawful basis plus a controller-processor agreement. Monitoring employees for it is separate processing that needs its own basis and a DPIA.
Two problems
Organisations arrive with one and leave with two.
Problem one: an employee pastes personal data into an AI tool. That is processing by a new recipient, usually involving an international transfer, and it needs a lawful basis and a controller-processor agreement.
Problem two: you deploy monitoring to detect problem one. That is separate processing of employee personal data, needing its own lawful basis, a DPIA, and in several member states a works council consultation.
Solving the first by creating an unassessed second is a common and avoidable mistake.
Not legal advice. The answer differs by member state, and national employment law sits on top of GDPR.
Problem one
More than the transfer rule engages here.
The last row is the one that tends to end the debate internally: if a data subject exercises their right to erasure and part of their data was pasted into a consumer AI account, you have no contractual route to comply.
| Obligation | What it means here |
|---|---|
| Lawful basis | The original basis for holding the data almost certainly does not extend to disclosing it to a third-party model provider |
| Art. 28 processor terms | A controller-processor agreement is required. An employee’s personal free-tier account has none |
| Chapter V transfers | Most major providers process outside the EEA. Needs a transfer mechanism and, in practice, a TIA |
| Purpose limitation | Data collected to deliver a service, now used to generate a marketing draft, is a new purpose |
| Art. 5(1)(f) integrity | Uncontrolled disclosure to an unassessed recipient is difficult to reconcile with this |
| Arts. 15–17 subject rights | You cannot honour erasure for data sitting in a third party you have no agreement with |
Minimisation drives the product decision
Art. 5(1)(c), applied to DLP tooling, is a comparison.
Both architectures achieve the purpose. One is demonstrably the less intrusive means, and once a less intrusive means demonstrably exists and works, “we transmitted everything because it was simpler” becomes a harder position to defend in an assessment.
When the system never receives message content, several sections of your DPIA get considerably shorter.
| Cloud-inspection DLP | On-device detection | |
|---|---|---|
| Employee personal data collected | Full content of every inspected message | Type, count, confidence, masked snippet, destination |
| Additional processors involved | The DLP vendor | None for content: it never leaves the device |
| Additional international transfer | Usually yes | No |
| Available in a breach of the vendor | Message content | Redacted records only |
| Erasure request scope | Message archive | Event records |
A sequence that works
The order these steps need to happen in.
The works council step is slower than the technical deployment. Start it first.
- 01
Assess the AI tools already in use
Including the ones nobody approved.
- 02
Sanction one, properly
Art. 28 terms, a transfer mechanism, and good enough that people prefer it.
- 03
Publish an AI use policy
Naming what may never be pasted anywhere.
- 04
Run the DPIA for the monitoring
With minimisation genuinely analysed rather than asserted.
- 05
Consult the works council
Where required, and it is the longest pole.
- 06
Notify employees in advance
Including what is not collected.
- 07
Deploy log-only, tune, warn, then block
In that order, without shortcuts.
- 08
Set retention per framework
And actually enforce it.
- 09
Re-assess annually
And whenever a provider changes terms.
Lawful basis
Legitimate interests needs a balancing test you can produce.
Two lawful basis questions arise here and they get tangled together, which is why the answers tend to be vague.
The first is the basis for the processing that happens when personal data is sent to an AI provider. That is ordinary Article 6 analysis and it usually lands on legitimate interests or contract, depending on what the processing is for. The second is the basis for monitoring your own staff, which is where consent is not available in any useful sense, because an employee cannot freely refuse. Legitimate interests is the realistic basis, and it requires a documented balancing test weighing the purpose against the intrusion.
The balancing test is the artefact a regulator asks for, and it is materially easier to write for a control that inspects content on the device and records a category than for one that transmits and stores the message. That is not a legal opinion, it is an observation about which version of this is easier to justify, and your DPO owns the conclusion.
Transfers
Where the model runs is a transfer question.
Chapter V applies whether or not anybody thought about it, and an AI provider is a case where the processing location is frequently unclear from the interface.
If personal data reaches a provider processing outside the EEA, you need a transfer mechanism: adequacy, standard contractual clauses, and in practice a transfer impact assessment to go with them. Several providers now offer regional processing commitments, and those commitments are usually tied to a specific tier or a specific deployment rather than to the product generally, which is the detail that gets lost between a procurement conversation and what staff actually use.
The limit worth being plain about: a control at the point of sending can keep personal data out of a transfer, which is the cleanest answer to the question. It cannot retrospectively supply a mechanism for transfers that have already happened, and the period before the control existed is a question for your DPO rather than for a product.
Questions
Is pasting customer data into ChatGPT a GDPR breach?
It is at minimum unauthorised processing by a new recipient. Whether it is a personal data breach requiring notification depends on the circumstances and on your assessment, but an undocumented disclosure to an unassessed processor is an issue regardless of how that assessment lands.
Do we need a DPIA for AI DLP monitoring?
Systematic monitoring of employees generally meets the DPIA threshold. The assessment is also where the architecture of your chosen tool becomes relevant, because minimisation asks whether the purpose could have been met by collecting less.
Can we rely on employee consent?
Rarely. Consent must be freely given, and regulators have consistently treated the employment relationship as undermining that. Legitimate interest with a documented balancing test is the more usual footing.
Does using an EU-hosted AI provider solve the transfer problem?
It addresses the transfer question specifically. It does not by itself address lawful basis, purpose limitation, retention, subject rights, or whether the disclosure was authorised in the first place.
Does Itzal see the message itself?
No. The check runs in a small program on the device, and the raw text is never transmitted, stored off the device, or written to a log. Your console receives finding types, frameworks and the action taken.
How long does deployment take?
One installer, pushed by your existing MDM. There is no appliance, no proxy and no certificate to distribute, and turning on another product later is a licence change rather than a second rollout.
What does Itzal not see?
Plenty, and we publish it rather than wait to be asked. Coverage is reported per surface and the uncovered ones are named. Surface coverage.
Is this enough on its own for an audit?
No control is. Itzal gives you the evidence for one surface: what was found, which framework it mapped to, what happened next, and which devices were covered when it happened.
Do we need to tell employees?
Several US states and most EU member states require advance written notice for endpoint monitoring, and some require works council consultation. That is a question for your counsel, not for us. What we know, and what we don’t.
Can we rely on employee consent for monitoring?
Realistically no. Consent must be freely given, and an employee cannot freely refuse their employer. Legitimate interests is the workable basis, and it requires a documented balancing test weighing the purpose against the intrusion. That test is the artefact a regulator will ask to see.
Keep reading
- HIPAA No AI tool is HIPAA compliant on its own Compliance depends on a BAA and on how you use the tool. What counts as PHI in a prompt, and what a disclosure is. 6 min read
- Product Privacy architecture Itzal runs detection on the endpoint and transmits only a redacted event record. Read the page
- Product Deployment Signed installers through Intune, Jamf, Kandji or Ansible, browser extension by policy. Product page
- PCI DSS What happens when a PAN reaches a chatbot Pasting a primary account number into an AI tool puts card data in an unassessed system. What PCI DSS requires of you. 6 min read