GDPR Checklist
GDPR compliance for AI startups
AI products often ingest user content and may make automated decisions — triggering some of GDPR's strictest provisions.
Common risks
- • Training on personal data without a lawful basis
- • Automated decisions without Art. 22 safeguards
- • Sending user data to third-party LLM APIs without disclosure
- • No way for users to delete data already fed into systems
Your checklist
- Establish and document a legal basis for any personal data used in training
- Disclose use of third-party AI providers as sub-processors
- Provide human review for significant automated decisions (Art. 22)
- Minimise and pseudonymise personal data in prompts and logs
- Honour erasure requests across stored data and derived records
- Run a DPIA for high-risk processing (Art. 35)
FAQs
Is sending prompts to an LLM API a data transfer?
Yes — if prompts contain personal data, the API provider is a sub-processor and any transfer outside the EEA needs safeguards like SCCs.
Do I need a DPIA?
Likely yes if you do large-scale or high-risk processing, profiling, or automated decision-making.