Your Team Is Probably Breaching GDPR Right Now. With AI.

Not with some rogue database. Not with a phishing attack. With the AI tools you're actively encouraging them to use.

We spent the last few weeks stress-testing how ChatGPT, Claude, and Gemini hold up against GDPR when employees use them the way employees actually use them — pasting in client names, deal terms, support tickets, HR data.

The short version: most organisations are wide open.

Here's what's going wrong.

There's no legal basis for the processing

The moment personal data hits a chatbot prompt, that's processing under Article 4(2). But where's the lawful basis under Article 6? The data subject didn't consent to their details being fed to OpenAI. And we've yet to see a company that's run a legitimate interest assessment covering AI chatbot use.

There's no DPA in place

Article 28 requires a Data Processing Agreement with any processor handling personal data on your behalf. Free and Plus tier ChatGPT? No DPA. And that's what the vast majority of employees are using. Enterprise tiers fix this, but how many of your staff are actually on one?

Data is leaving the EU

These tools route data through US infrastructure. The EU-US Data Privacy Framework provides a mechanism, but it only applies where the specific provider is certified and you've actually verified that. Most companies haven't checked.

No one has done a DPIA

Widespread use of AI chatbots with personal data is exactly the kind of systematic, high-risk processing that triggers Article 35. It's not optional. And almost nobody has done one.

Subject access requests are a nightmare

If a client exercises their rights under Articles 15–22, can you account for data that's been sent to a third-party AI provider? Can you retrieve it? Delete it? Confirm whether it was used for model training? Good luck.

The EDPB is already watching

And here's the kicker: the EDPB's 2026 coordinated enforcement action is focused squarely on transparency obligations under Articles 12–14. That means regulators across the EU will be looking at exactly this kind of gap.

This isn't a future problem. It's happening in your organisation today.

We'd love to hear from DPOs — are you seeing this on your radar, or is AI chatbot use still flying under the compliance team's attention?