Using ChatGPT in a GDPR-compliant way.
Sooner or later the question comes up in every company: are we actually allowed to do this? The short answer is that it depends on the conditions. This page explains what the GDPR requires of using an AI chat service, which routes exist, and what makes a rollout fail in practice. No legal advice, but a checklist you can put in front of your data protection team.
Why private use at work becomes a problem
The technology is not the problem; the missing framework is. As soon as employees enter personal data or trade secrets into a service the company has no contract with, a third party processes that data without a legal basis.
No data processing agreement
Art. 28 GDPR requires a contract with every service provider that processes personal data on your behalf. With a privately created account that contract does not exist – and the company remains responsible all the same.
Unclear purpose limitation
Without a contractual assurance it is open whether inputs are stored, analysed or used to improve models. Yet that is exactly what a company has to know and be able to document.
No control over access
Who entered what, and when? Without central user management that cannot be answered – and when employees leave, their access remains.
Shadow AI instead of a ban
A ban rarely solves the problem. It merely moves the use onto private devices, where it becomes invisible. The more effective route is to offer something that meets the requirements.
The checklist: six questions for any provider
These points decide whether an AI service can be used in a company in a data-protection-compliant way. Get every answer in writing.
Contract and responsibility
- Is there a data processing agreement under Art. 28 GDPR – in place before the first use?
- Which sub-processors are involved, and will you be informed about changes?
- How are data subject rights such as access and erasure implemented technically?
Data and technology
- Where exactly is the data processed, and does it leave the European Economic Area?
- Are inputs used to train models or stored after the answer has been given?
- Is there central user management for granting and withdrawing access?
This page is no substitute for legal advice. It summarises which points are checked in practice – assessing the individual case belongs in the hands of your data protection officer. Which providers work as a replacement is covered on Alternatives to ChatGPT.
Three routes that work in practice
A business plan with the provider
The large providers have enterprise plans with a data processing agreement and an assurance that inputs are not used for training. What remains to be checked is the place of processing, the sub-processors and the user management.
A platform operated in Europe
A provider offers the models through its own platform, signs the data processing agreement with you and takes care of hosting, user management and deletion. That is how novendix.AI works – the terms are on the page Pricing.
Running it yourself in-house
Models on your own hardware. Maximum control, but also full responsibility for operation, updates and security – uneconomical for most mid-sized IT departments.
How novendix.AI addresses these points
Not as promises, but as verifiable commitments.
- Processing takes place in a German data centre – as the default, not as a paid option.
- Only models are enabled for which it is contractually guaranteed that requests are neither used for training nor stored after the answer has been given.
- The data processing agreement under Art. 28 GDPR is anchored in the terms and conditions and is made available to you on request.
- Every licence belongs to exactly one named person; access is granted and withdrawn centrally.
- Chats, files and memories can be exported and deleted.
The details, including the points we deliberately do not claim, are on Privacy & Security. Which models are enabled is shown by AI models at a glance.
Frequently asked questions
Is using ChatGPT at work forbidden?
No. Nothing is forbidden – what is required is a legal framework. It becomes problematic when employees enter personal data or trade secrets through private accounts for which the company has signed no data processing agreement. With a business plan, or through a platform with a corresponding contract, the use is possible.
What makes an AI service GDPR-compliant?
Six things at heart: a data processing agreement under Art. 28, transparency about sub-processors, a known place of processing, an assurance that inputs are not used for training, the technical feasibility of data subject rights, and central user management.
Is training the staff enough?
Training is necessary but not sufficient on its own. Without an approved tool, shadow AI appears: the use happens anyway, just uncontrolled. What works is the combination of a compliant offering, an understandable policy and training.
May personal data be entered?
With a data processing agreement and a suitable legal basis, in principle yes, within the defined purposes. Without that framework, no. Independently of this, the principle of data minimisation applies: only the data genuinely needed for the task should be entered.
Where is data processed at novendix.AI?
In a German data centre. That is the default, not a paid add-on. Details are on the Privacy and Security page.
Hand the checklist to your data protection team
We put together the documents your review needs – and we also say where we cannot yet provide evidence.
Your secure AI platform for the Mittelstand. Secure. Intelligent. Integrated. Custom database integration, personally supported.
novendix GmbH · Industriestraße 6 · 91126 Schwabach
Locations: Schwabach · Weißenburg · Nuremberg
A company of the L&S Lange & Schermer Group
