Data protection for AI projects: legal basis, DPIA, data processing agreement, role of the DPO

Most SMB AI use cases touch personal data: in prompts, RAG indexes, call recordings, CVs. The GDPR allows this, but expects decisions written down before go-live. After this guide you will have a data map for the use case, a documented legal basis, a decision on whether a DPIA is needed (and the DPIA if it is), a signed data processing agreement (AVV) with every vendor, and a DPO who was involved on time and not after the fact.

Why it matters

• The duties already apply. The AI Act adds to the GDPR, it does not replace it; for high-risk systems it expects deployers to use the provider's information for their DPIA (Art. 26(9) AI Act). The GDPR applies to every use case.
• Fines and orders. Breaches of Art. 5, 6, 9 or 44 ff. GDPR can be fined up to EUR 20 million or 4 % of worldwide annual turnover, and breaches of Art. 28, 35 or 38 up to EUR 10 million or 2 % (Art. 83 GDPR) [1]. For SMBs, an order to stop a processing operation your process depends on is often the bigger risk.
• The German authorities have said what they expect. The Datenschutzkonferenz (DSK) has published guidance on selecting and using AI applications (May 2024) [2] and on technical and organisational measures for developing and operating AI systems (version 1.0, June 2025) [3]. Its official DPIA list names AI explicitly (see below) [4].

When you need it

Rule of thumb: no real personal data in a pilot before legal basis and AVV are in place; until then use synthetic or anonymised data (DATA-005, DOC-018).

Who is involved

• Management (controller): carries legal responsibility, decides on residual risks, signs the AVV. The DPO advises; the decision stays with management.
• Data protection officer (DPO): must be "involved, properly and in a timely manner, in all issues which relate to the protection of personal data" (Art. 38(1) GDPR) and must be consulted when a DPIA is carried out (Art. 35(2)). In Germany, a DPO is mandatory if at least 20 persons are regularly engaged in automated processing of personal data, or regardless of headcount if you carry out processing that requires a DPIA (§ 38(1) BDSG) [5]. A repeal of the 20-person threshold has been announced politically but, as of October 2026, the provision still applies; check the current text before you rely on any change.
• Department lead: purpose, data flows, users of the output. IT / IT security: hosting, access, logging, deletion (GUIDE-013). HR and works council: all employee data, where most DPIA triggers sit (GUIDE-004). Legal/counsel: contracts, transfers, professional secrecy.

Step by step

1. Map the data flow (2-4 hours per use case). Write down which personal data goes in (prompts, files, indexed documents, recordings), about whom (staff, customers, applicants, third parties), where it is processed (vendor, region, sub-processors), whether it trains the vendor's models, who sees outputs, and retention. GUIDE-003 delivers most of this. Watch for hidden data: a RAG assistant over the file server (KNOW-002) also indexes HR folders unless you exclude them.

2. Define the purpose and choose the legal basis (1-2 hours with the DPO). Each purpose needs its own basis under Art. 6 GDPR: - Contract (Art. 6(1)(b)), e.g. processing a customer's order email in AGENT-004 or answering their service request in CONV-001. - Legitimate interest (Art. 6(1)(f)) is the typical basis for internal productivity uses such as summarising, drafting or searching. It requires a documented three-step test: legitimate interest, necessity, balancing against the data subjects' interests and reasonable expectations. The EDPB confirmed in Opinion 28/2024 that this basis can be used for AI, but only after this case-by-case assessment, and that AI models trained on personal data are not automatically anonymous [6]. - Consent (Art. 6(1)(a)) works for optional customer-facing features. Rarely for employees (dependency).

Employee data: after the CJEU ruling C-34/21 (30 March 2023) the general clause in § 26(1) sentence 1 BDSG is widely considered no longer applicable as a stand-alone basis [7]. In practice, base employee processing on Art. 6(1)(b), (c) or (f) GDPR, or on a works agreement that contains specific, protective rules (Art. 88 GDPR).

Special categories (Art. 9 GDPR), such as health data, biometric data for identification (VIS-016) or data revealing union membership, need an additional exception from Art. 9(2). Otherwise keep them out.

Automated decisions (Art. 22 GDPR): if the AI output effectively decides about a person with legal or similarly significant effect, for example rejecting applicants in CV screening (AGENT-008, CONV-019), Art. 22 applies. Keep a human who really reviews and can overrule.

Note: the Commission's "Digital Omnibus" proposal from November 2025 would change parts of the GDPR, including rules on processing for AI. As of October 2026 these GDPR changes are still in the legislative procedure, unlike the AI Act changes in Regulation (EU) 2026/1744. Plan with the current GDPR.

3. Decide whether a DPIA is required (30 minutes; document the result either way). A DPIA is required when processing is "likely to result in a high risk" (Art. 35(1)), in particular for systematic and extensive evaluation of persons, large-scale special categories, or systematic monitoring (Art. 35(3)). The German DPIA list for the private sector ("Muss-Liste", version 1.1) names, among others [4]: - No. 11: use of AI to process personal data to control interaction with data subjects or to evaluate personal aspects, with examples such as AI customer support and a call centre that automatically analyses callers' mood; - No. 8: extensive processing of data on employees' behaviour that can be used to evaluate their work with legal or other significant consequences; - No. 13: automated analysis of video or audio recordings to evaluate personality.

The list is not exhaustive. In practice, plan a DPIA for: customer chatbots and voicebots that process personal data (CONV-001, CONV-002), call analytics (SPEECH-002), CV screening and AI interviews (AGENT-008, CONV-019), performance and attrition analytics (LANG-036, PRED-012), biometrics (VIS-016). A drafting assistant without personal data in its sources usually needs none; write down why.

4. Carry out the DPIA (2-5 days for a typical SMB use case). Minimum content under Art. 35(7): description of the processing and purposes, necessity and proportionality, risks to the persons concerned, and measures to address them. AI-specific risks: invented outputs about real people, bias, leakage between users, vendor training on inputs, deletion from indexes and logs, function creep into performance monitoring. Use [2][3] as a checklist for measures. Where appropriate, seek the views of data subjects or their representatives (Art. 35(9)); in practice this is often the works council. If a high residual risk remains, you must consult the supervisory authority before starting (Art. 36).

5. Sign the data processing agreement (AVV) with every processor (1-3 hours per vendor). Every cloud AI service, transcription tool or integrator that processes personal data on your behalf needs an AVV under Art. 28 GDPR [1]. Check in particular: - processing only on your documented instructions; no use of your inputs and outputs to train the vendor's models (or a clear opt-out that you have actually set); - list of sub-processors (model provider, hosting) and the right to object to changes; - data location, and for transfers outside the EU/EEA the mechanism (adequacy decision such as the EU-US Data Privacy Framework for certified companies, or standard contractual clauses); - deletion and return at the end of the contract, retention of logs and prompts; - support with data subject requests, breach notification, audits and DPIAs.

The Commission's standard clauses for processors (Implementing Decision (EU) 2021/915) are a useful benchmark [8]. Large vendors offer only their own terms; compare and document gaps. Consumer accounts of AI tools usually come without an AVV, one reason to ban them for business data (GUIDE-007).

If the vendor uses your data for its own purposes (e.g. training), it is not a pure processor and you need a separate legal basis for passing the data on, which is hard to justify. Rule this out.

6. Implement measures and transparency (part of the project plan). Update the record of processing (Art. 30) and privacy notices (Art. 13/14). Set retention for prompts, transcripts and logs (they are personal data too). Restrict indexed sources, use role-based access and pseudonymisation. Make access and erasure requests cover indexes and logs (SEC-018 helps at scale).

7. Review on change. Repeat steps 1-3 on a new model or vendor, new sources, purposes or groups of people; review at least yearly.

Checklist

• [ ] Data map for the use case: data, persons, systems, locations, retention, training use
• [ ] Purpose and legal basis documented per purpose; balancing test written for Art. 6(1)(f)
• [ ] Employee data: basis checked after CJEU C-34/21, aligned with works council / works agreement
• [ ] Art. 9 and Art. 22 checked (special categories, human review)
• [ ] DPIA decision documented (DSK Muss-Liste nos. 8, 11, 13 checked); DPIA done if required
• [ ] DPO involved and opinion documented; DPO appointment duty under § 38 BDSG checked
• [ ] AVV signed with every processor; training on your data excluded; sub-processors and transfers checked
• [ ] Record of processing, privacy notices, retention and deletion (incl. indexes, logs) done
• [ ] Review date and change triggers set

Templates & tools

• DSK "Künstliche Intelligenz und Datenschutz" (May 2024): selection and use checklist [2]; DSK TOM guidance for AI systems (June 2025): measures by lifecycle phase [3].
• DSK DPIA list for the private sector (version 1.1) [4] and the DSK short papers ("Kurzpapiere") on DPIA and processing on behalf, available from the DSK website [9].
• EDPB Opinion 28/2024 [6]; EU processor clauses 2021/915 as AVV benchmark [8].

Common pitfalls

• DPO informed after the contract is signed. Make DPO sign-off a pilot gate (GUIDE-009).
• "The vendor is GDPR-compliant" taken as enough. You remain the controller.
• Training on inputs left switched on. Often on by default in free tiers; check setting and contract.
• RAG index over everything. Limit sources and inherit permissions.
• No DPIA "because it is only a pilot". Real data in a pilot is real processing.
• Treating data protection and co-determination separately. For employee-related AI, run DPIA and works council consultation in parallel; the same facts feed both.

Sources

1. Regulation (EU) 2016/679 (GDPR), consolidated text, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj
2. Datenschutzkonferenz (DSK): Orientierungshilfe "Künstliche Intelligenz und Datenschutz", version 1.0, 6 May 2024 (press release): https://datenschutzkonferenz-online.de/media/pm/2024_05_06_DSK_PM_OH_KI_und_Datenschutz.pdf
3. DSK: Orientierungshilfe zu empfohlenen technischen und organisatorischen Maßnahmen bei der Entwicklung und beim Betrieb von KI-Systemen, version 1.0 (June 2025), referenced in DSK resolution: https://datenschutzkonferenz-online.de/media/en/DSK_Entschliessung_DSGVO_KI_Anpassungen.pdf
4. DSK: Liste der Verarbeitungstätigkeiten, für die eine DSFA durchzuführen ist, nicht-öffentlicher Bereich, version 1.1 (17 Oct 2018), published by HmbBfDI: https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/DSFA_Muss-Liste_fuer_den_nicht-oeffentlicher_Bereich_-_Stand_17.10.2018.pdf
5. Bundesdatenschutzgesetz (BDSG), § 38: https://www.gesetze-im-internet.de/bdsg_2018/__38.html
6. EDPB: Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (17 Dec 2024): https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
7. CJEU, judgment of 30 March 2023, C-34/21 (Hauptpersonalrat): https://curia.europa.eu/juris/liste.jsf?num=C-34/21 ; guidance by the Hessian DPA: https://www.datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-05/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf
8. Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors: https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj
9. Datenschutzkonferenz, guidance and short papers overview: https://www.datenschutzkonferenz-online.de/

Accessed 2026-10.