GDPR-compliant AI

GDPR-compliant AI: how to recognise it – and what it takes

“GDPR-compliant” now appears on almost every AI website. As a seal of approval the term is useless, because it is not the tool that complies, but the way your company uses it. This page shows what a provider has to put in place, what you need to settle yourself – and how we do it at novendix.AI.

Seven-point checklistHosted in GermanyNo seal promises

What “GDPR-compliant” means for AI in practice

Four questions decide whether you can use an AI tool in your company with a clear conscience. All four can be answered in writing – if they cannot, that is your answer.

Is there a data processing agreement?

As soon as personal data is involved – a customer email, a CV, meeting minutes – you need a data processing agreement (DPA) under Art. 28 GDPR. Without one, the processing is not permitted, however good the technology.

Where is the data processed?

What matters is where data is processed and stored, not where the model vendor has its headquarters. Transfers to third countries need additional safeguards and documentation.

Are your inputs used for training?

Inputs that flow into model training cannot be taken back. The exclusion belongs in the contract, not just in a setting someone might switch back on by accident.

Can usage be controlled and proven?

Who has access, who manages the accounts, how is data deleted when someone leaves the company? In an audit you must be able to show how data was handled.

The checklist for any AI solution

Whichever provider you choose: these seven points should be settled before you start.

DPA under Art. 28 GDPR. Signed or validly agreed, including the list of sub-processors.
Named processing location. Data centre in Germany or the EU, confirmed in writing. Exceptions must be disclosed openly.
No training, no retention at the model provider. Excluded by contract – ideally as Zero Data Retention.
Central account management. Accounts belong to the company; rights can be granted and revoked by role.
Technical safeguards. Encrypted transfer, two-factor sign-in, backups and a documented deletion concept.
Internal AI policy. Which data may go in, which may not, and who to ask. Your data protection officer belongs at this table.
Staff training. Since February 2025, Art. 4 of the EU AI Act requires sufficient AI literacy from everyone who uses AI systems in the company.

What this means for ChatGPT specifically is covered in Using ChatGPT in a GDPR-compliant way; secure alternatives are compared in ChatGPT alternatives for businesses. What the EU AI Act requires beyond that is explained in The EU AI Act for SMEs.

Free account, business licence or platform compared

Three ways AI arrives in companies today. The difference rarely lies in the quality of the answers, but in the framework around them.

Criterion	Private free account	Business licence from a large vendor	Platform hosted in Germany (e.g. novendix.AI)
DPA	No	Yes	Yes, part of the terms and conditions
Processing location	Usually unspecified, often the US	Depends on vendor and plan, EU data residency selectable in some cases	Platform in Germany, models in EU data centres
Training on inputs	Often enabled by default, can be switched off	Usually excluded in business plans	Excluded by contract, only models with Zero Data Retention
Rights management	None	Yes	Yes, with roles and teams
Model choice	One vendor	One vendor	Several model families through one login
Contact person	None	Support or partner	Dedicated personal contact

General classification, not an assessment of individual providers. Actual terms depend on the respective contract.

How novendix.AI handles data protection

We do not sell a seal. We describe what is behind it technically and contractually – including the points where data can leave the EU.

Platform in Germany, models in the EU. By default, novendix.AI runs in a German data centre and the language models in data centres within the EU.
Only models with Zero Data Retention. A model is only enabled if the contract guarantees that it does not train on customer data and does not store requests. Our gateway rejects models without this commitment.
Data processing covered. The DPA under Art. 28 GDPR is part of our terms and conditions and can also be viewed on a separate page (in German).
Backups and access protection. Daily encrypted backups to Frankfurt, immutable for 60 days. Two-factor sign-in in all plans, administration only via VPN.
No third-party resources loaded. The interface loads nothing from external servers, and speech recognition runs on our own servers.
Exceptions named openly. For image generation (only the prompt, checked for personal data first), app connections, push notifications and web search, data can leave the EU. You decide whether to use these features.
Certification presented honestly. Our infrastructure provider is ISO 27001 certified. Our own information security management system is being set up – we do not claim a certificate of our own.

All details on hosting, encryption and sub-processors are on Privacy and security. Why the processing location matters more than where a model comes from is explained in European AI.

Three steps to GDPR-compliant use of AI

Set the rules

Agree an AI policy with your data protection officer: permitted data, prohibited data, responsibilities. Where the risk to individuals is high, carry out a data protection impact assessment.

Introduce a tool with a contract

Provide a solution with a DPA, a named processing location and a training exclusion – so nobody has to fall back on private accounts.

Enable your staff

Training on possibilities and limits, shared templates and a contact for questions. This also meets the AI literacy obligation under the EU AI Act.

Our onboarding workshop covers steps two and three and ends with a written 90-day roadmap. What such a roadmap looks like is shown in AI rollout in 90 days. Why bans alone do not help is explained in Shadow AI in the workplace.

Frequently asked questions about GDPR-compliant AI

Is there such a thing as GDPR-compliant AI?

No tool is GDPR-compliant in itself. Use is compliant when the legal basis, DPA, processing location, training exclusion, rights management and internal rules are in place. A provider can create the technical and contractual conditions – the rules for your company remain your responsibility.

Is ChatGPT GDPR-compliant?

The private free account is unsuitable for personal data because there is no DPA. With a business plan, a DPA and an internal policy, compliant use is possible. Details are on Using ChatGPT in a GDPR-compliant way.

Is it enough if the server is in the EU?

It is an important requirement, but not the only one. Equally important are the DPA, the exclusion of training and retention at the model provider, and which sub-processors are involved.

Do we need a data protection impact assessment?

Under Art. 35 GDPR, when processing is likely to result in a high risk to individuals – for example the systematic evaluation of employees or applicants. For use as a writing and research assistant it is often not mandatory, but the assessment should be documented. Decide this with your data protection officer.

May we process personal data in novendix.AI?

Yes, on the basis of the DPA and your own legal basis. For the features where data can leave the EU – image generation, app connections, push notifications and web search – your policy should state whether and how they are used.

How quickly can we start?

The trial account is activated after a manual check of your registration and runs for ten days free of charge, without payment details. After that you book from one user, with no minimum purchase.

Is there a GDPR-compliant AI chat?

Yes – what matters is not the chat itself but the framework: a DPA, a named processing location, exclusion of training and retention at the model provider, and central rights management. novendix.AI is such an AI chat for businesses: the platform runs in a German data centre, the models in data centres within the EU, and only models with Zero Data Retention are enabled.

Which AI is GDPR-compliant?

No AI is compliant in itself – not even a European one. Check every provider against the seven points of the checklist above: DPA, processing location, training exclusion, rights management, safeguards, internal policy and training.

Is there a free GDPR-compliant AI?

Hardly, for business use: free accounts usually come without a DPA and without a guaranteed processing location. You can test novendix.AI free of charge for ten days, without payment details – after that from €25 per user per month plus VAT.