GDPR checklist for ai services tools.
AI providers receive prompts and files, which can contain personal data of customers or staff. Compare 2 common tools and see what to check for each.
OpenAI
AnthropicWhat to check for ai services tools
- Decide what personal data may be sent in prompts, and block the rest.
- Check whether inputs are retained or used for training under your plan.
- Record the provider and the purpose in your privacy policy.
- Check for automated decisions about people, which carry extra duties under Article 22.
All ai services tools
Questions, answered.
What should I check before using an ai services tool under the GDPR?
Decide what personal data may be sent in prompts, and block the rest. Check whether inputs are retained or used for training under your plan. Record the provider and the purpose in your privacy policy. Check for automated decisions about people, which carry extra duties under Article 22.
Do I need a data processing agreement with an ai services provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which ai services tools does Privacyboard cover?
OpenAI, Anthropic. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.