Contact

Data under control in AI projects We help determine whether AI can legally use customer, employee and user data

We help determine whether AI can legally use customer, employee and user data-without derailing implementation through legal uncertainty.

Check whether your use of data in AI is lawful

AI needs to move fast. Data must not follow blindly.

A company wants to implement an AI tool, but questions arise: can we use customer data? Can the model be trained on historical data? Is the prompt sent to the provider? Does the data leave the EEA? Is a DPIA required?

For AI projects, the question is not only whether the tool works. The question is whether the data on which it operates can be used lawfully and whether that use can be justified to a customer, employee, the management board or a regulator.

Natalia Lener-Bobek

Partner

CHALLENGES

Where does data most often create risk in AI?

It is unclear which data may be used The team wants to test or implement AI using customer, employee or user data, but there is no clear legal basis.

Ongoing support

We assess the purpose, scope of data and legal basis for a specific use case.
Data is sent to an external tool The company does not know where the data goes after a prompt is entered, who has access to it or whether it is used further.

A secure process

We map data flows, providers, sub-processors and cloud-related risks.
Transfers outside the EEA are unclear The AI tool operates globally, but no one has reviewed the transfers, safeguards or the provider's terms.

Risk assessment

We review data transfers, agreements and the required safeguards.
No DPIA has been carried out AI affects people, decisions, profiling or automation, but no data protection impact assessment has been carried out.

GDPR support

We prepare a DPIA or determine whether one is required for the process.

OUR SOLUTION

Operational GDPR for AI

We do not write abstract privacy opinions. We review the actual data flow and translate it into a decision: proceed, proceed conditionally, change the model or stop a specific use case.

AI use case

Scope:

  • AI purpose
  • input data
  • users
  • impact on individuals
  • assessment of what the risk concerns

Lawfulness

Scope:

  • legal basis
  • purpose of processing
  • data minimisation
  • retention
  • decision: go / conditional / change the model

DPIA

Scope:

  • high risk
  • automation
  • profiling
  • risk-mitigation measures
  • a DPIA or a decision on whether one is required

Suppliers

Scope:

  • agreements
  • sub-processors
  • cloud services
  • transfers outside the EEA
  • a safer model for working with the provider

Transparency

Scope:

  • clauses
  • privacy policies
  • notices to individuals
  • information about AI
  • documentation ready to address questions.

Rules

Scope:

  • AI use policy
  • instructions for employees
  • checklists
  • red flags
  • fewer errors in everyday use of AI

Incidents

Scope:

  • breach analysis
  • notifications
  • communications
  • remediation plan
  • a faster response and reduced business impact
Check whether your use of data in AI is lawful

WHO IS THIS SERVICE FOR?

this service is for you if

You are a DPO, Legal Manager or Compliance Manager

and need to translate GDPR, DPIA, transfer and transparency requirements into specific decisions for an AI project.

You are a Product Manager, Head of IT or AI Project Owner

and want to know which data you can use in AI, what to avoid and how to prevent the implementation from being blocked at the final stage.

You are a CEO, COO or management board member

and want to implement AI faster while keeping data, reputational and management liability risks under control.

HOW WE WORK

From uncertainty to a decision

Mapping

We review data, tools, suppliers and data flows.

Decision

We assess legality, DPIAs, transfers and transparency.

Structure

We update documents, rules, clauses and procedures.

Response

We support you with questions, incidents and new use cases.

Check the legal status of data used in AI.

Check whether your use of data in AI is lawful

CONTACT US

Implementing AI? Check whether your data is ready for the project.

Protecting privacy does not require innovation to be blocked. What matters is knowing which data may be used in AI, on what basis, subject to which restrictions and what must be disclosed to customers, employees or a regulator.

Tell us which AI tool you are implementing, which data is to be used and in which process: HR, marketing, customer service, sales, product development, analytics, scoring or automation. Indicate whether this concerns a test, an implementation, a live system, a customer enquiry or an incident.

Natalia Lener-Bobek

    By submitting this form, you acknowledge that the personal data you provide will be processed by Kancelaria Prawna Sawaryn i Partnerzy sp.k. to handle your enquiry and contact you about it. Details are available in our Privacy Policy. The rules governing the use of this website are set out in the Terms and Conditions.