GDPR-Compliant AI: What German Businesses Need in 2026

GDPR-compliant AI means every AI deployment in a German company is legally and organisationally reviewed before rollout: a lawful basis under Art. 6 GDPR, transparency towards data subjects, a data processing agreement, a third-country transfer review and, where risk is high, a DPIA under Art. 35 GDPR.

• GDPR-compliant AI is not a vendor badge but a documented compliance process before and during deployment.
• Critical checkpoints: lawful basis, DPA, data minimisation, Art. 22 GDPR, security measures and international transfers.
• Germany adds § 26 BDSG for employee data and works council co-determination under § 87(1) No. 6 BetrVG.
• First AI Act rules apply since 2 February 2025, further chapters since 2 August 2025, general application from 2 August 2026.

GDPR-compliant AI means that businesses in Germany deploy AI systems only where the lawful basis, transparency obligations, data processing agreements, data transfers and risk assessments are properly documented. Anyone feeding personal data into chatbots, copilots, enterprise search, HR tools or analytics models needs more than a contract with the vendor — they need a defensible compliance process under the GDPR (Regulation (EU) 2016/679), the BDSG (Federal Data Protection Act) and, depending on the use case, the EU AI Act (Regulation (EU) 2024/1689).

For many companies, this is the practical question behind searches such as “GDPR-compliant AI” or the German equivalent “datenschutzkonforme KI”: which minimum requirements actually apply in 2026 before a tool is approved for use? This guide gives the short answer first, then the implementation detail. It is general information, not legal advice; for an operational review framework, start with our GDPR AI vendor assessment checklist.

What does “GDPR-compliant AI” mean?

GDPR-compliant AI describes an AI deployment in which every processing of personal data rests on a valid lawful basis, data subjects are properly informed, vendor relationships are contractually secured, international transfers are covered by an adequate mechanism and high-risk processing is preceded by a DPIA — all demonstrably governed inside your organisation.

It is therefore not a certificate or a feature the vendor can sell you. What matters is whether the specific deployment in your company meets the requirements of the General Data Protection Regulation and is internally governed. The same tool can be deployed compliantly in one company and unlawfully in another. At minimum, establish:

• a lawful basis for every processing of personal data under Art. 6 GDPR
• compliance with the information obligations under Art. 13 and 14 GDPR
• an assessment of whether solely automated decisions within the meaning of Art. 22 GDPR occur
• a Data Protection Impact Assessment (DPIA) under Art. 35 GDPR where high risk exists
• a data processing agreement (DPA) under Art. 28 GDPR where the vendor acts as processor
• a defensible approach to third-country transfers under Chapter V GDPR

The German market regularly adds further layers. For employee data, § 26 BDSG applies. Where co-determination is triggered — AI in HR, productivity measurement or knowledge work — § 87(1) No. 6 BetrVG (Works Constitution Act) must be considered early, before go-live, not after.

German regulatory guidance points to the same priorities. The Datenschutzkonferenz (DSK), the joint body of German data-protection authorities, highlights in its orientation guidance “AI and Data Protection” of 6 May 2024 responsibilities, internal rules, transparency and the frequent DPIA obligation. The BfDI (Federal Commissioner for Data Protection) added its AI questionnaire in 2025, focused on documented lawful bases, role allocation, transfers, contract management and data subject rights.

GDPR requirements for AI systems at a glance

Many teams start with the wrong question: “Is this tool GDPR-compliant?” The legally sounder one is: What processing takes place, and what obligations does it trigger?

This overview is the right starting point for most corporate AI deployments:

Review area	Key provision	Core question for your business
Lawful basis	Art. 6 GDPR	On what legal ground may the data be processed?
Special-category data	Art. 9 GDPR	Are health, biometric or similarly sensitive data involved?
Transparency	Art. 13/14 GDPR	Are employees, customers and applicants adequately informed?
Data processing	Art. 28 GDPR	Does the vendor act on your behalf, and is a DPA in place?
Security and TOMs	Art. 32 GDPR	Are access controls, encryption, deletion and logging regulated?
DPIA	Art. 35 GDPR	Is there a high risk due to scale, profiling or effects on data subjects?
Automated decisions	Art. 22 GDPR	Does the AI produce significant decisions without meaningful human control?
Third-country transfer	Chapter V GDPR	Is data transferred to the US or other third countries?

Lawful basis for processing personal data

The rule applies to AI as elsewhere: no processing without a lawful basis. Three grounds under Art. 6 GDPR typically carry corporate AI deployments:

1. Performance of a contract (Art. 6(1)(b) GDPR) where processing is strictly necessary to deliver the service to the data subject.
2. Legal obligation (Art. 6(1)(c) GDPR) where statutory duties drive the use case.
3. Legitimate interests (Art. 6(1)(f) GDPR) where a legitimate business purpose exists and the interests of data subjects do not override it.

Consent is cited too quickly in AI projects. In the employment context it is rarely robust because of the dependency between employer and employee; a documented balancing of interests under Art. 6(1)(f) GDPR usually serves internal use cases better.

Transparency obligations under Art. 13 and 14 GDPR

Where AI systems process personal data, data subjects must be able to understand:

• which data is processed
• for what purpose the AI is used
• whether external vendors are involved
• whether data flows to third countries
• which rights they have

Transparency fails most often because business units switch AI features on before privacy notices, works agreements or internal policies are updated — a gap that quickly creates avoidable enforcement risk with enterprise search, copilot or HR tools.

Solely automated decisions under Art. 22 GDPR

Art. 22 GDPR is often reviewed late even though it can be central. It applies where a decision is made solely by automated means and produces legal effects or similarly significantly affects the data subject.

Typical risk fields include:

• automated applicant screening
• scoring of customers or credit applicants
• performance and behavioural evaluation of employees
• pricing or access decisions with significant external effects

A paper-only “human in the loop” is not enough: if reviewers merely confirm automated outputs, Art. 22 can still apply.

Data Protection Impact Assessment under Art. 35 GDPR

A DPIA is not reserved for large corporations. It must be assessed whenever the AI deployment is likely to result in a high risk to the rights and freedoms of natural persons. This is particularly common with:

• extensive processing of employee or customer data
• profiling and scoring
• special-category data under Art. 9 GDPR
• systematic monitoring
• new technologies with hard-to-estimate effects

German practice offers a concrete benchmark: the DSK standard list of processing operations requiring a DPIA explicitly captures AI-based scoring and profiling. For hands-on execution, see our support on Data Protection Impact Assessments; for vendor screening itself, use our GDPR AI vendor assessment checklist.

Data processing agreements and the DPA obligation

As soon as an external AI vendor processes personal data on your behalf, you generally need a data processing agreement under Art. 28 GDPR — a common practical error is confusing marketing claims such as “GDPR ready” with a sound contractual position. Our data processing agreement guide covers the mechanics.

An effective DPA must at least regulate:

• subject matter and duration of the processing
• nature and purpose of the processing
• categories of personal data
• categories of data subjects
• the vendor’s obligation to act only on your instructions
• sub-processors
• technical and organisational measures
• support with data subject rights and security incidents

For how different contract and transfer models look in practice, see our analyses of Anthropic GDPR compliance and Claude under GDPR.

Typical privacy problems when companies deploy AI

Most problems arise during selection, configuration and approval, not live operation. Four risk areas appear in almost every project we review.

1. Training data and personal data

Whether prompts, uploads or business documents stay out of model training depends not on a sales slide but on the product variant, the contract and the technical configuration. Verify:

• does the vendor train on customer data by default, optionally, or not at all?
• does the exclusion apply only to enterprise plans or also to API use?
• is zero data retention or an equivalent setting available?
• are support or abuse-review processes excluded from training or not?

Remember that personal data can sit not only in the prompt itself but also in uploaded documents, conversation histories, knowledge bases and metadata.

2. Purpose limitation and data minimisation

The GDPR requires that personal data be processed only for specified, explicit and legitimate purposes. In AI projects this collides with the open-ended mindset of “let’s test broadly first”. Before rollout, companies should define:

• which use cases are permitted
• which data categories may be entered
• which departments may use the tool
• which workflows are excluded

An internal AI usage policy is therefore not a nice-to-have but a core element of GDPR-compliant AI adoption.

3. Profiling, scoring and employee data protection

As soon as AI detects patterns about people, prioritises, evaluates or predicts, the step to profiling is small — not only at banks and insurers but also at:

• recruiting tools
• sales and lead scoring
• fraud detection systems
• productivity and performance analytics
• customer service and churn models

In Germany, employee data adds two layers: § 26 BDSG governs employment-context processing, and works council co-determination under the BetrVG applies to systems that can monitor performance or behaviour. Innovative systems regularly fail not on data processing as such but because co-determination, transparency and governance were organised too late. Where AI touches hiring, credit or education, AI Act high-risk obligations may also apply — see our EU AI Act deadline checklist.

4. Third-country transfers with US vendors

Many AI vendors process data in the US or rely on US-based sub-processors, so the third-country transfer question arises almost automatically. Verify:

• where data is stored and processed
• which Standard Contractual Clauses (SCCs) apply
• whether supplementary measures are required
• which sub-processors are involved
• whether an “EU region” is technically and contractually airtight

Many teams underestimate that EU hosting does not automatically rule out support, security or operational access from third countries.

Practical operating rules for German businesses

Between clean legal theory and a defensible rollout lies company practice. Businesses that want GDPR-compliant AI in daily operations should define internal minimum rules and treat them as a gate.

Governance rule 1: Maintain an AI inventory and a rollout gate

Record every AI tool in use, including shadow IT, with data categories, vendor, configuration and purpose. No business unit rolls out AI alone: IT, security, legal, data protection and the affected department sign off before go-live; for HR use cases the works council joins from the start.

Governance rule 2: Put approved and prohibited use cases in writing

A positive and negative list prevents a fundamentally permissible tool from later being used for impermissible purposes. Typical exclusions:

• special categories of personal data without separate approval
• client confidences or highly sensitive M&A documents
• fully automated decisions with significant external effects
• covert employee monitoring

Governance rule 3: Assess the configuration, not just the vendor

The same tool can be legally very different depending on product tier, region, API setting, training opt-out or retention options. GDPR-compliant AI is always also a question of technical configuration.

Governance rule 4: Make documentation audit-ready

At the latest when the data protection officer, a supervisory authority or the works council asks, the company must be able to explain why the deployment is legally defensible. That typically includes:

• an approval note or assessment record
• the lawful basis and balancing of interests
• DPA and transfer documentation
• a DPIA or a documented negative assessment
• the usage policy and training records

Governance rule 5: Re-review on a fixed cadence

Vendors change features, data flows and contracts continuously, so a one-time review is not enough: re-check at least annually and upon material changes. Buyer-side due diligence is its own discipline — our GDPR AI procurement guide covers vendor selection and contract negotiation beyond this implementation guide.

How GDPR and the EU AI Act interact

The EU AI Act has been in force since 1 August 2024. Under Art. 113, Chapters I and II apply since 2 February 2025, further governance and GPAI provisions since 2 August 2025, and the Regulation applies in principle from 2 August 2026. Art. 6(1) and its related obligations for embedded high-risk systems follow from 2 August 2027.

The key point for companies: GDPR and the EU AI Act pursue different objectives and apply in parallel.

• The GDPR asks: may personal data be processed this way?
• The EU AI Act additionally asks: which obligations apply to this AI system by risk class, role and context of use?

In practice this means:

• An AI deployment that is lawful under data protection law can still trigger separate AI Act obligations.
• A technically well-documented AI system can still violate the GDPR if lawful basis, transparency or a DPA are missing.
• Companies need neither an isolated “AI Act check” nor an isolated “GDPR check” but an integrated AI governance model.

This is especially relevant for high-risk areas such as employment, credit, education, biometric identification or critical infrastructure. For the strategic implementation of these dual obligations, see our overview of AI Act and GDPR legal advisory.

Frequently asked questions

What does GDPR-compliant AI mean for my business?

Treat every AI deployment like a regulated procurement and governance project: before rollout, review purpose, data categories, lawful basis, role allocation, vendor documentation, transfers and risks — then approve.

Are ChatGPT or Claude automatically GDPR-compliant?

Not with a blanket yes or no. What matters is the plan tier, contract terms, data types, retention and training rules, third-country transfers and the specific use case — conduct your own documented assessment rather than relying on vendor statements.

Do I always need a DPA for AI tools?

Not automatically for every tool, but for many SaaS and API services, yes. The deciding factor is whether the vendor processes personal data on your behalf. If so, a DPA under Art. 28 GDPR is mandatory. If the vendor uses data for its own purposes, a different role allocation may apply, which must be assessed separately.

When is AI particularly risky in a company?

Where sensitive or employee data, profiling, scoring or decisions with significant effects on people are involved. Also: undisclosed data use, unclear third-country transfers and open input fields without internal policies.

Is the EU AI Act enough for compliance?

No. The EU AI Act does not replace the GDPR. Even where a vendor presents its product as AI Act ready, data protection obligations such as lawful basis, transparency, data subject rights, DPA and DPIA remain independently applicable. Companies must consider both regimes together.

Next step for your business

If you are introducing GDPR-compliant AI or reviewing existing AI workflows, start not with abstract policies but with the actual data flow and tool setup — that determines whether a DPA, DPIA, transfer review, works council involvement or AI Act classification is required.

Compound Law supports companies in Germany and the DACH region with AI procurement, DPA review, data protection governance, DPIAs, AI Act readiness and vendor contract negotiations. For a first operational assessment, start with our GDPR AI vendor assessment checklist or request a conversation about AI Act and GDPR legal advisory.

---

This article provides general information on GDPR-compliant AI, the GDPR and the EU AI Act. Whether a specific AI deployment is lawful depends on data types, role allocation, technical configuration, industry and the actual effects on data subjects, and should be legally assessed on an individual basis.