By Niek Beerens · Published on October 10, 2026

GDPR and AI: What Can You Do With Customer Data?

Using AI while staying GDPR compliant: what you can do with customer data, when you need a DPA, and how to set it up correctly as an SME.

More and more businesses are routing customer data through AI tools, chatbots and automations. A WhatsApp agent that answers questions, a CRM that automatically creates leads, an n8n workflow that processes form data: they all have one thing in common. They touch personal data.

The General Data Protection Regulation (GDPR) has not changed just because AI became more popular. The rules that apply to a spreadsheet full of customer data also apply to an AI agent that reads, stores or forwards that same data. The difference is that the risks with AI are greater: more data, faster processing, less visible to the customer.

This article explains what you need to arrange as a business owner before you let customer data flow through AI tools.

The GDPR applies as soon as you process personal data. That means data that can directly or indirectly identify a person: name, email address, phone number, IP address, but also behavioural data from your CRM or chat histories.

For processing you need a legal basis. The most commonly used bases in small and medium-sized businesses are:

Performance of a contract: you process data because the customer is using a service.
Legitimate interest: you have a legitimate business interest that outweighs the individual’s privacy.
Consent: the data subject has explicitly agreed.

AI does not change the legal basis, but it makes it harder to substantiate. If an AI agent analyses a chat history to profile a customer, that does not automatically fall under the performance of a contract. You need to be able to explain why you process that data and how long you retain it.

When Do You Need a Data Processing Agreement?

A Data Processing Agreement (DPA) is mandatory whenever you engage a third party that processes personal data on your behalf. That third party is called a processor. When you send customer data to an external AI platform, that platform is in most cases a processor.

Think of:

An AI chatbot running on the API of OpenAI or Anthropic (Claude)
An automation tool like n8n that moves customer data between systems
A CRM like GoHighLevel that stores customer data
A WhatsApp integration that processes messages through an external service

For each of these parties, check:

Is a DPA included in their terms of service?
Where is the data stored? Preferably within the EU.
Which sub-processors do they use? Large platforms often rely on sub-service providers.

Major providers such as OpenAI, Anthropic and Make have DPA documentation available. You do need to actively accept it and be able to demonstrate that you have done so.

What Can You Use Customer Data For in AI?

This is the question most business owners skip. They connect their CRM to an AI tool and include customer data in prompts without thinking about the purpose.

A few practical rules of thumb:

Send Only the Data That Is Necessary

If an AI agent needs to send a follow-up email, it usually only needs the name and email address. Not the full customer history, no financial data, no notes from previous conversations, unless that is strictly necessary for the task.

Do Not Train Models on Customer Data Without a Legal Basis

Some AI services use your data by default to improve their models. That is generally not permitted without explicit consent from the data subject. Check the settings of each tool and disable this where possible.

Special Categories Are Extra Sensitive

Health data, political opinions, religion, sexual orientation: these are special categories of personal data. The GDPR prohibits processing them unless a specific exception applies. AI tools that analyse customer conversations can unintentionally pick up special category data. That is a risk you need to actively manage.

A Record of Processing Activities

Every business that processes personal data is required to maintain a record of processing activities. This contains:

Which categories of personal data you process
For what purpose
On which legal basis
How long you retain the data
Which external parties receive the data

When you introduce AI automations, you add the new processing activities to that record. This is not a paper exercise for large corporations. The supervisory authority can ask for it, and in the event of a data breach it is the first thing they will request.

The article on secure automation goes deeper into how you set up access control and data management technically, which ties in directly with what you need to document legally.

Transparency Towards Customers

Your customers have the right to know that their data is being processed. In most cases you cover this through your privacy policy. If you deploy AI in a way that is not directly visible to the customer, such as an AI agent reading along in support tickets, you need to disclose that.

In addition, customers have the right to:

Access: they can request to see what data you hold on them.
Correction: they can have incorrect data amended.
Erasure: in certain circumstances they can request deletion of their data.

If customer data is stored in multiple places, in your CRM, in the logs of an AI tool, in a Supabase database, you need to be able to update all those locations when a deletion request comes in. That is technically more complex than it sounds if your systems are not properly connected.

What to Arrange Before Going Live

A practical checklist for every AI project involving customer data:

Inventory which personal data flows through the automation
Check that all external service providers offer a DPA
Set data retention policies: how long do you keep chat histories, form submissions and logs?
Limit data transfer to what is strictly necessary for the task
Add the new processing to your record of processing activities
Update your privacy policy if the AI deployment is visible to customers
Check whether data is transferred outside the EU and whether that is permitted

At NRL Automations we start every project with an inventory of what needs to be arranged technically and legally before we build a single API connection. Security and compliance are not an afterthought. They are a starting point.

GDPR does not stop you from using AI. It does require you to think about what you are doing and why. Businesses that handle this well build more trust with customers and face less risk when incidents occur.

Want to know how to set up an AI automation that is properly structured from day one? Plan a conversation via /#boeken and we will look together at where the opportunities and the risks lie.

Curious what could be automated in your business?

Book a call