Catalog / Data Readiness for AI / PREP-025

GDPR purpose & legal-basis check for reusing data in AI

A structured check whether existing customer, employee and supplier data may be reused for an AI purpose, with documented legal basis, DPIA need, processor agreements and information duties.

Parts needed to run it yourselfAgents & automationLanguage model

Many SMB AI projects stall late, when someone asks: "May we actually feed our customer e-mails, HR files or supplier data into this tool?" A lightweight, repeatable check clarifies purpose, legal basis, DPIA need, processor agreements and information duties before the pilot starts. AI can help prepare the paperwork, but the decision stays with people and the data protection officer (DPO).

Problem & value

  • Today: data was collected for contracts, payroll or support. Nobody documented whether summarising it with an LLM, building a search index or training a classifier is a compatible new purpose. Projects either start without a check (risk) or wait months for an answer (cost).
  • Value: a one-page decision per data source and per use case; fewer blocked pilots; a documented accountability trail (Art. 5(2) GDPR) that auditors, customers and works councils can read.
  • Why it matters for AI: the European Data Protection Board (EDPB) explicitly addresses legitimate interest, compatible reuse and unlawfully trained models in its 2024 opinion on AI models [1]. German supervisory authorities publish practical guidance for deployers [2].

Variants

  • Customer data (CRM, tickets, e-mails): usually Art. 6(1)(b) or (f); information duties and objection right matter most.
  • Employee data (HR files, time sheets, chat): consent is rarely free in employment; §26 BDSG and works agreements dominate.
  • Public sector: legal basis from statute (Art. 6(1)(e)), purpose limitation and procurement rules are stricter.

How it works

  1. use-case description + data fields
  2. map to VVT entries (original purpose, legal basis, retention)
  3. compatibility test (Art. 6(4) GDPR) or new legal basis
  4. DPIA screening (Art. 35) + special categories (Art. 9)
  5. processor check (AVV, sub-processors, third-country transfer)
  6. information duties and objection/opt-out design
  7. decision memo, signed by DPO and process owner
  • Where AI helps: an LLM can pre-fill the questionnaire from the VVT, draft the decision memo, compare vendor terms against a checklist and propose text for privacy notices. It does not decide legality and may hallucinate article numbers; every output is verified against the law text.
  • Human-in-the-loop: the DPO (internal or external) signs off; the department lead confirms the real purpose and data fields.

Data preparation

Which data: the VVT (Art. 30), existing privacy notices, consent records, vendor contracts and AVVs, and a field-level description of the data planned for the AI use case.

Where it lives: Excel or Word VVT, a privacy tool, SharePoint or Nextcloud folders, contract folders, HR system, CRM.

Typical gaps: outdated VVT, no retention periods, unclear data origins, missing AVVs for new SaaS features (e.g. AI add-ons switched on by default), privacy notices that do not mention AI.

Preparation steps: 1. Update the VVT for the systems the AI will touch (about 1-3 days per department; PREP-001, PREP-003). 2. List data fields per use case and strip what is not needed (data minimisation; PREP-002). 3. Where possible pseudonymise or anonymise before use (PREP-022). 4. Check access rights so the AI cannot expose more than users may see (PREP-023). 5. Classify which data may go into which tool (PREP-024).

Rough share of effort: low; mostly a few days of DPO and process-owner time per use case.

Implementation paths

Which path for whom

  • SMB - Path A: the process is standard, and EU-hostable privacy-management tools and DPO services exist at SMB prices; the AI part is a small add-on.
  • Enterprise - Path B: many use cases and systems justify an intake workflow on the existing platform, calling a cloud LLM API for pre-filling and drafting.
  • Developer - Path C: a self-hosted n8n flow with a local model keeps contract and HR text in-house.
  • Public - Path C: statutory legal bases, sensitive citizen data and procurement rules favour sovereign or self-operated hosting.
  • Privacy-management suites with VVT, DPIA and AVV modules: DataGuard, Proliance 360, 2B Advice PrivacyManager, Privacy Office (German vendors, EU hosting; verify per contract).
  • Office AI: Microsoft 365 Copilot (EU Data Boundary) or Gemini in Workspace to summarise vendor terms and draft memos; mind works-council duties because usage is logged.
  • External DPO service as an alternative to a tool; often 0.5-1 day per use case.
  • Choose A when: fewer than about 10 AI use cases and no in-house legal team.

Path B - Build on cloud APIs

  • Intake form (Microsoft Forms, Power Automate or n8n) feeds a prompt with VVT extracts; EU-region endpoints (Azure OpenAI in EU regions, Mistral AI Studio (formerly La Plateforme) as EU provider, Google Vertex EU) return a draft memo and checklist.
  • Choose B when: you want the check embedded in your own project-intake process.

Path C - Self-host (open source)

  • n8n (self-hosted) plus Ollama or vLLM with an open-weight model such as Mistral Small, Llama or Qwen; Paperless-ngx or Nextcloud as document store.
  • Hardware HW1 for simple checklists, HW2 for long contracts; setup 2-5 days for someone with n8n experience.
  • Worth it when contract and HR content must not leave the company.

Path D - Custom training

Not sensible. Retrieval over your VVT and checklists is enough; legal reasoning does not need fine-tuning.

State of the art (2026)

  • The EDPB opinion 28/2024 sets out a three-step legitimate-interest test for AI models and says that unlawfully processed training data can affect later deployment [1]. National authorities, e.g. the DSK guidance on AI and data protection, give deployers checklists [2].
  • The Digital Omnibus (Regulation (EU) 2026/1744) changes AI Act timelines, not the GDPR basics; the GDPR [3] check remains a separate duty (AI Act [4]).
  • LLM assistants draft memos well but confuse articles, national rules and exceptions. Use them for drafts, not for conclusions.

Shared resources & combinations

Effort, cost & KPIs

  • Path A: 1-3 days per use case incl. DPO time; tool licences vary by vendor.
  • Path B: 3-8 days to build the intake flow, then hours per use case.
  • Path C: 1-2 weeks including server setup.
  • KPIs: lead time from request to decision, share of AI use cases with documented basis before pilot, number of AVVs missing at go-live (target zero), updated VVT coverage.

People & change

Involve early: management (accepts residual risk), the process owner, IT, the DPO and the data owners. Legal/compliance for vendor terms, HR when employee data is involved (GUIDE-005, GUIDE-010).

Works council: depends. If the check concerns employee data or tools that log user behaviour, §87(1) no. 6 BetrVG applies because objective suitability for monitoring is enough; §90(1) no. 3 requires timely information on AI-supported work processes, and §80(3) allows an AI expert. Public bodies involve the Personalrat. Only companies with an elected works council are affected (GUIDE-004).

DPO and DPIA: a DPIA (Art. 35 GDPR) is likely for systematic evaluation of people, special categories or new technology at scale; every processor needs an AVV (Art. 28 GDPR).

AI literacy: Art. 4 AI Act, as amended by Regulation (EU) 2026/1744, obliges providers and deployers to take measures that support staff's AI literacy; add a short module on what data may enter which tool (GUIDE-006, GUIDE-007).

Communication and pilot: present the check as an enabler ("fast green light"), not a brake. Pilot with one department and two data sources; name the DPO as a partner and a department AI champion (GUIDE-008, GUIDE-009).

Humans in control: the DPO and process owner sign; the AI only drafts.

Risks, regulation & compliance

  • GDPR: purpose limitation (Art. 5(1)(b), 6(4)), transparency (Art. 13/14), data minimisation, Art. 9 special categories, third-country transfers (Chapter V). Employee data: §26 BDSG.
  • EU AI Act: minimal for the check itself; Art. 50 transparency duties apply since 2 Aug 2026 where users interact with AI; Annex III high-risk duties (e.g. HR selection) apply from 2 Dec 2027 (GUIDE-014).
  • This text is practical guidance, not legal advice.

Getting started

  1. Pick one planned AI use case and list the data fields and sources.
  2. Pull the matching VVT entries and note original purpose and legal basis.
  3. Run the compatibility and DPIA screening with the DPO in a 90-minute session.
  4. Request or check AVVs and update privacy notices.
  5. Record the decision and re-check at the next major vendor or feature change.

Sources

  1. EDPB - Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models - https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
  2. DSK - Orientierungshilfe "Künstliche Intelligenz und Datenschutz" (2024) - https://www.datenschutzkonferenz-online.de/orientierungshilfen.html
  3. Regulation (EU) 2016/679 (GDPR) - https://eur-lex.europa.eu/eli/reg/2016/679/oj
  4. Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj
  5. Microsoft - EU Data Boundary - https://learn.microsoft.com/privacy/eudb/eu-data-boundary-learn
  6. n8n - self-hosting documentation - https://docs.n8n.io/hosting/