AI and the GDPR: where does your data go?

In the chat: use a business account

Paste a customer file into a free or personal chat account, and you share it with a company your organisation has no contract with. With most personal accounts, the provider may use your conversations to train its models unless you turn this off.

The Dutch data protection authority has already received breach reports about staff who pasted patient data or customer addresses into a chatbot. If this happens against your internal rules, it is a data breach that you often have to report.

Business plans such as ChatGPT Business or Enterprise, Claude Team or Enterprise, Microsoft 365 Copilot and Gemini in Google Workspace come with a data processing agreement. By default, the provider then does not train on your data. If you connect the chat to Odoo, your Odoo data falls under the terms of that account. A connection to Odoo therefore belongs with a business account.

In your systems: the whole chain must be in order

When AI works with Odoo through an API, an agent or an MCP connection, your company remains responsible for the data. The AI provider processes it on your behalf, under a data processing agreement that also covers its subprocessors. The built-in AI of Odoo 20 also sends your question and the record’s data to OpenAI or Google through Odoo.

If a provider operates outside the EU, the transfer needs a valid basis, such as the EU-US Data Privacy Framework or standard contractual clauses. Choose processing in the EU where possible. Send only the fields the task needs, and give an agent read access only at first.

Do not let AI make decisions about people without a real human review, for example about job applicants or credit limits. In August 2026, the Dutch data protection authority fined Uber almost 825 million euros for blocking drivers fully automatically.

For an agent that works with customer or staff data, a DPIA, a data protection impact assessment, is often mandatory. Also record every AI processing activity in your record of processing activities and your privacy notice.

On top of that: the AI Act

Since 2 August 2026, a chatbot must tell people that they are talking to AI, unless this is obvious. Companies that use AI must also take measures to support the AI literacy of their staff.

Stricter rules apply from 2 December 2027 to AI used for recruitment, staff management or credit assessment.

The proposed relaxation of the GDPR through the Digital Omnibus is not law yet. Until then, the current GDPR applies, including a report to the data protection authority within 72 hours after a data breach.

How we handle AI connections

For every AI connection, we map which data goes to which provider, under which contract and in which region. We start with read access, limit what an agent can do and add an approval step. You can revoke access at any time.

This page outlines the framework. If you process sensitive data, also get legal advice, for example from your DPO or lawyer.

More about AI in Odoo