Consent is not the only possible legal basis
Article 6 GDPR provides several legal bases. The appropriate basis depends on the purpose and circumstances. Special categories of personal data additionally require consideration of Article 9.
A blanket claim that entering personal data into any AI tool is unlawful without consent is too broad. Equally, stating that a service is hosted in Europe is not enough.
Four questions about the data route
Data minimisation, a clear processing purpose, retention periods and limited access provide the starting point. Processor arrangements under Article 28, safeguards under Article 32 and, where relevant, international transfers form part of a combined assessment.
- Document purpose and legal basis
- Review the agreement and subprocessors
- Organise deletion and data-subject rights
- Assess risks and whether an impact assessment is needed
Technology supports implementation
Masking, access controls and logs can reduce risk and make processes reviewable. The requirement for a legal basis remains. AI Link onboarding connects technical and organisational requirements with the responsible people in the business.
Sources & further reading
Original research, provider documentation and further reading on the concepts and figures discussed here.