GDPR for AI in practice

During the workshop, we assess whether your AI use case involves personal data, where the risks lie and what needs to be put in place (roles, rules and documentation) so that AI can be implemented safely and predictably.

Book a call about your AI use case

AI is already in use within the organisation. The rules usually are not… yet.

It is usually not the technology that causes problems, but the lack of clear arrangements. The team is testing AI, while the organisation still lacks clarity about what data enters the process, who is responsible for what and on what basis the solution can be scaled safely (and quickly).

The point is not to say ‘no’ to AI. The point is to establish where personal data is involved, what the actual risks are and what needs to be put in order so that the project can proceed.

Natalia Jabcoń

Sales Manager

CHALLENGES

The most common problems we solve

AI moves faster than the rules Teams are testing tools and providers are demonstrating new capabilities, but the organisation has no single, shared framework for assessing data, risks and responsibilities.

View solution

We establish the rules: the use case, roles and scope of documentation needed to run the project safely.

We analyse the AI operating model and identify what must be agreed at the outset and what can be refined at later stages.

Less disorder, faster decisions and easier scaling of future implementations.

Every new project starts from scratch, and the same mistakes recur in subsequent use cases.

It is unclear whether AI involves personal data at all The team uses AI but still lacks certainty about what data is entered into the tool, where it comes from and what happens to it afterwards.

View solution

We map the data and determine whether the project falls within the scope of the GDPR.

We establish what data appears in the process, the purpose for which it is used and the boundaries of a safe operating model.

No more guesswork - a prompt decision on whether the implementation can proceed (and how).

The project relies on assumptions that may prove unsound during an audit, incident or scaling exercise.

The roles of the client and provider are unclear The company purchases an AI solution but is unsure who acts as controller, processor or joint controller, and what obligations follow from those roles.

View solution

We clarify roles, responsibilities and the model for working with the provider.

We review the relationships between the client, provider, integrator and internal teams and identify the necessary safeguards (contractual and procedural).

Greater contractual control and fewer risks hidden in the cooperation model.

The organisation assumes responsibility that it does not understand or has not addressed in the contract.

AI supports decisions about people, but no one has assessed the consequences Segmentation, scoring, recommendations or candidate pre-selection are used in HR, sales, marketing or customer service, but their legal and operational consequences have not been assessed.

View solution

We assess whether the process involves profiling or automated decision-making.

We examine risk areas, information obligations and the level of safeguards required for the process concerned.

You can use AI in a process that is defensible both operationally and legally, without the risk of unexpected issues.

The tool works, but the organisation cannot explain how it affects individuals or the basis on which it does so.

Each new use case has to be analysed from scratch There are no rules for using AI, escalation paths or repeatable documentation model, so each issue has to be reinvented from scratch.

View solution

We build an operational foundation that can be applied to future implementations.

We prepare rules for using AI, documentation recommendations and a decision-making framework.

The organisation gains a structured approach, not a one-off opinion.

AI scales faster than control over the process.

OUR SOLUTION

What exactly the GDPR for AI service includes

This is not a just-in-case analysis. We work on a specific AI use case and deliver decisions, recommendations and a set of materials that provide practical support for implementation.

AI use-case analysis and data mapping

the solution’s business objective
types of data in the process
data sources and information flows
users, providers and the implementation context

a use-case map and clarity as to whether and where personal data is involved

Assessment of roles and responsibilities

the role of the client, provider and other parties
allocation of responsibilities within the operating model
matters requiring contractual or procedural safeguards

a clear, structured model of roles and obligations

Assessment of the lawfulness of data use in AI

training, testing and validation
supplying tools with customer, employee or candidate data
alignment of the purpose of processing with the planned use case

a recommendation on what is permissible, under what conditions and what needs to change

Assessment of AI-specific GDPR risks

profiling and automated decision-making
data minimisation and retention
transparency and accountability
information obligations and matters requiring further analysis

a list of actual risks and priorities for action

Review of the model for working with AI providers

the need for a data processing agreement or other provisions
restrictions on the provider’s use of data
required organisational and contractual safeguards

recommendations for working with the provider and a list of provisions to be addressed

Rules for using AI within the organisation

what is and is not permitted
what data is excluded
when an issue must be escalated
how to standardise team practices

working rules for employees and teams on the use of AI

Documentation and implementation support

DPIA and risk analysis
recommendations concerning information obligations
project documentation
embedding requirements in the actual business process

working rules for employees and teams on the use of AI

WHO THIS SERVICE IS FOR

Who most often needs this support

This service is for organisations that want to use AI in practice without building their project on assumptions.

Compliance Manager

needs to assess an AI use case quickly and turn the findings into specific recommendations for teams.

Director of Digital Transformation

wants to implement AI more widely but needs rules that will structure cooperation between the business, IT and providers.

Management Board Member / COO

expects a model that enables AI to be scaled while maintaining control over risk, responsibility and decision-making.

STAGES OF WORK

How we work together

We follow a structured process to move from ‘we do not know’ to a decision, without shifting responsibility or producing documents that look good but do not help the project.

Set the business context and map use cases

We learn about the tool, its purpose, data types, users, providers and operating model.

Assess legal and operational risks

We identify where personal data is processed in practice, the relevant roles and obligations, and where risks arise.

Recommend safeguards

We turn findings into concrete contractual, organizational, disclosure, documentation and process recommendations.

Implement and formalize decisions

We support DPIAs, documentation, AI usage rules and integrating recommendations into the business process.

Stages of work

Let us run a quick check: what really happens to the data in your AI system?

A single conversation will help determine whether you need a use-case assessment, structured rules or implementation support, and what the first steps should be.

Three sentences are enough: tell us what tool is involved, what stage you have reached, what data may be used and what your main concern is. We will ask about the remaining details during the call.