GDPR and AI: Privacy-Compliant AI Deployment in Companies 2026

57 percent of German companies say, according to the latest Bitkom study, that data protection restricts the application of AI in the EU. At the same time, AI adoption has nearly doubled within a year: 36 percent of companies use artificial intelligence—almost twice as many as in 2024. The tension between innovation pressure and data protection obligations has never been greater than now. Because 2026 is the year in which three regulatory frameworks are enforced simultaneously at full strength: the GDPR, the EU AI Act, and the NIS2 Directive. Those deploying AI without a data protection strategy risk not only fines—but the trust of customers, partners, and employees.

Why GDPR-Compliant AI Is Now Business-Critical

The year 2026 marks a regulatory turning point. The German Data Protection Conference (DSK) has significantly tightened enforcement against AI projects under its chairman Prof. Dr. Tobias Keber. The message to the business community is unmistakable: 2026 will be the year of documentation and accountability.

Three Regulations Hit Simultaneously

The GDPR remains the foundation. But supervisory authorities have changed the assessment standard. Data Protection Impact Assessments (DPIAs) are no longer viewed as one-time documents but as ongoing instruments for evaluating and managing risks. The DSK explicitly emphasizes that most corporate AI projects now fall under the mandatory criteria for a DPIA pursuant to Article 35 GDPR. Those operating AI systems that process personal data must be able to demonstrate a fully documented impact assessment—otherwise fines and, in extreme cases, operational bans are at stake.

The EU AI Act takes full effect for high-risk AI systems from August 2, 2026. This includes applications in personnel selection, creditworthiness assessment, education, and critical infrastructure. Companies must have completed conformity assessments, finalized technical documentation, and registered their systems in the EU database by then. The sanctions: up to 15 million euros or 3 percent of global annual revenue for violations in the high-risk area, up to 35 million euros or 7 percent for prohibited AI practices. The AI competence obligation under Article 4 has been in effect since February 2025.

The NIS2 Directive was transposed into German law in December 2025. The registration deadline with the BSI expired on March 6, 2026—and the result is alarming: only 4,856 entities have registered, although approximately 30,000 companies are affected. Those who missed the deadline risk fines of up to 10 million euros or 2 percent of global annual revenue. Particularly critical: the personal liability of management.

The Tension: Innovation Versus Data Protection

The Bitkom Study 2026 paints a differentiated picture. 81 percent of surveyed companies say the GDPR makes business processes more complicated. 54 percent see data protection as a direct obstacle to AI deployment in their own company. At the same time, 58 percent acknowledge that data protection creates legal certainty for AI. The problem is therefore not data protection itself—but the lack of clarity on how it is compatible with AI systems in practice.

The mid-market particularly suffers from redundant reporting obligations under GDPR, AI Act, and Data Act. Bitkom president Dr. Ralf Wintergerst puts it bluntly: data protection has become the number one brake on digitalization. The solution lies in a structured approach that combines compliance and innovation.

The Legal Foundations: What You Specifically Need to Observe

Legal Bases for Data Processing by AI

Every processing of personal data by an AI system requires a legal basis under Article 6 GDPR. The three most relevant options for companies are:

Consent (Art. 6(1)(a) GDPR): Fundamentally possible, but often difficult in practice. Consent must be voluntary, informed, and specific. The EDPB clarified in its Opinion 28/2024: if personal data was unlawfully processed during the development of an AI model, supervisory authorities can impose fines or order the deletion of the data.

Legitimate interest (Art. 6(1)(f) GDPR): The EDPB confirmed in December 2024 that legitimate interest can fundamentally serve as a legal basis for the development and deployment of AI models. However, a three-step test is required: identification of a legitimate interest, demonstration of the necessity of the processing, and a balancing test ensuring that the controller’s interests do not override the rights of the data subjects.

Contract performance (Art. 6(1)(b) GDPR): Applicable when AI processing is necessary for the performance of a contract with the data subject—for example, with AI-powered customer service for existing customers.

The Data Protection Impact Assessment: Mandatory for Almost All AI Projects

The DSK has updated its so-called must-list. It names processing operations for which a DPIA is mandatory. According to current regulatory guidance, most AI projects fall under these mandatory criteria, particularly when they:

• process personal data on a large scale
• perform automated decisions or profiling
• deploy new technologies
• involve sensitive data under Article 9 GDPR

From August 2026, operators of high-risk AI systems face an additional obligation: the fundamental rights impact assessment under Article 27 of the AI Regulation. The DPIA and the fundamental rights impact assessment do not replace each other—they complement each other.

The Data Processing Agreement: No AI Deployment Without a DPA

As soon as personal data is transferred to an AI provider, a data processing agreement (DPA) pursuant to Article 28 GDPR is mandatory. The free version of ChatGPT, DeepSeek, or comparable tools is practically not GDPR-compliant for companies processing personal data. Only the business or enterprise plans from OpenAI, Anthropic, and Google offer DPAs.

The data location is also decisive. Most leading AI providers are based in the United States. Data transfers are possible via the EU-US Data Privacy Framework, but the CLOUD Act obliges US companies to disclose data to American authorities—regardless of server location. For sensitive company data, a European or German hosting solution is therefore the safest option.

Practical Guide: GDPR-Compliant AI in Seven Steps

Step 1: Create an AI Inventory

Record all AI systems used in your company—whether official or as shadow AI. Document for each system: provider, data location, type of data processed, purpose, user group, and risk classification. This inventory simultaneously fulfills the requirements of the EU AI Act and forms the basis for your DPIA.

Step 2: Review and Document Legal Bases

For each AI system in the inventory: which legal basis under Article 6 GDPR applies? Has a DPA been concluded with the provider? Does consent or a legitimate interest exist? Document the review—even if the result is that no valid legal basis exists. Then you know where action is needed.

Step 3: Conduct a Data Protection Impact Assessment

Conduct a DPIA for every AI system that processes personal data. Describe the processing operations, realistically assess the risks, define protective measures, and assign responsibilities. Treat the DPIA as a living document: update it with every technical or organizational change.

Step 4: Implement Technical and Organizational Measures

Data protection by design is not optional but mandatory under Article 25 GDPR. Specifically, this means for AI systems:

• Access controls: who may enter which data into which AI system?
• Data minimization: only process data necessary for the purpose
• Pseudonymization: anonymize or pseudonymize personal data before inputting it into AI systems
• Logging: document all AI interactions traceably
• Deletion concept: clear rules for when and how data is removed from AI systems

Step 5: Create and Train on an AI Usage Policy

Create a clear, understandable AI usage policy. Maximum five pages, with concrete examples, defining: which data may be entered into which tools? Which use cases are permitted? What is prohibited? Train all employees and document the training—this simultaneously fulfills the AI competence obligation under Article 4 of the EU AI Act.

Step 6: Provide an Approved AI Platform

If you do not offer your employees an official, high-performance AI solution, they will find their own. The result is shadow AI—uncontrolled and not GDPR-compliant. Provide an approved platform that is hosted on German or European servers, has a DPA in place, and is at least as user-friendly as the freely available alternatives.

Step 7: Monitoring and Continuous Improvement

Establish AI usage monitoring with clear KPIs: adoption rate of the approved platform, shadow AI ratio, number of AI-related security incidents. Conduct quarterly internal audits. Update your AI inventory and DPIAs with every change.

Checklist: GDPR-Compliant AI Usage in the Company

• Checkpoint · Status · Responsible
• AI inventory of all deployed systems created · Open / Done · IT / Data Protection Officer
• Legal basis documented for each AI system · Open / Done · Data Protection Officer
• DPA concluded with all AI providers · Open / Done · Data Protection Officer / Procurement
• DPIA conducted for all relevant AI systems · Open / Done · Data Protection Officer
• Technical protective measures implemented (access, pseudonymization, logging) · Open / Done · IT
• AI usage policy created and communicated · Open / Done · Management / IT
• Employee training conducted and documented (Art. 4 EU AI Act) · Open / Done · HR / IT
• Approved AI platform provided · Open / Done · IT / Management
• Monitoring and reporting established · Open / Done · IT
• Quarterly audits scheduled · Open / Done · Data Protection Officer
• NIS2 registration with BSI completed · Open / Done · IT / Management
• Risk classification per EU AI Act documented · Open / Done · Data Protection Officer / IT

Practical Example: Staffing Agency with 85 Employees

A mid-sized staffing agency in North Rhine-Westphalia with annual revenue of 14 million euros. The recruiting team has been using three different AI tools since fall 2025: a resume screening tool, an AI assistant for creating job postings, and an analysis tool for candidate profiles. None of these tools were reviewed from a data protection perspective. There is neither a DPIA nor a DPA with the providers. Candidate data—name, address, qualifications, salary expectations—flows unlawfully to external servers.

The risk exposure in numbers:

• GDPR fine (personal candidate data processed without legal basis): up to 560,000 euros (4 percent of 14 million euros revenue)
• EU AI Act sanction (high-risk AI in HR without conformity assessment from August 2026): up to 420,000 euros (3 percent of revenue)
• Damages claims from rejected candidates under Article 82 GDPR: typically 1,000 to 5,000 euros per affected person—with 2,000 candidates per year, a risk in the millions
• Reputational damage: loss of client contracts if it becomes known that candidate data flowed uncontrolled to external AI providers
• Forensics and legal counsel: typically 100,000 to 250,000 euros

The total exposure conservatively exceeds 1.5 million euros—more than 10 percent of annual revenue. Particularly critical: AI in human resources qualifies as high-risk AI under the EU AI Act from August 2026. The company would then need not only GDPR compliance but additionally a risk management system, comprehensive technical documentation, transparency toward candidates, and human oversight.

The solution: within six weeks, the company introduced a GDPR-compliant AI platform, concluded DPAs, created a DPIA, and trained all employees. Cost: approximately 18,000 euros. Risk reduction: over 1.5 million euros.

Frequently Asked Questions

Do I need a Data Protection Impact Assessment for every AI tool?

Not for every one, but for most. The DSK has clarified that AI systems processing personal data generally fall under the mandatory criteria for a DPIA. This applies especially to automated decisions, profiling, the processing of sensitive data, and the large-scale deployment of new technologies. If you are unsure: conduct a threshold analysis. In case of doubt, it is safer and more cost-effective to create a DPIA than to risk a fine after the fact.

May my employees use ChatGPT or other AI tools?

In principle yes—but only under certain conditions. First: do not enter personal data into free AI tools. Second: only use business or enterprise versions for which a DPA exists. Third: a clear AI usage policy must exist that shows employees what is permitted and what is prohibited. Fourth: usage must be recorded in the AI inventory and considered in the DPIA. Without these framework conditions, usage is not GDPR-compliant.

What happens if an AI provider uses my company’s data for its training?

This is a real risk with free AI services. Many providers reserve the right to use entered data for training their models. Your company data—including personal data and trade secrets—could flow into a publicly accessible model. Review the terms of use carefully and prefer providers that guarantee opt-out from training or offer hosting on dedicated instances.

How does the fundamental rights impact assessment differ from the established DPIA process?

The fundamental rights impact assessment (FRIA) under Article 27 of the AI Regulation complements the DPIA but does not replace it. While the DPIA focuses on the protection of personal data, the FRIA assesses the impact of an AI system on a broader spectrum of fundamental rights—such as non-discrimination, freedom of expression, or access to public services. From August 2026, operators of high-risk AI systems must conduct both assessments. The good news: many aspects overlap, so both processes can be conducted efficiently in parallel.

My company has fewer than 50 employees. Do the same obligations apply?

Yes, the GDPR applies from the first employee and the first piece of personal data. The EU AI Act does provide reduced fine brackets for SMEs, but the fundamental obligations—AI inventory, AI competence, transparency, DPIA—apply to everyone. The conformity assessment for high-risk AI systems has no lower limit based on company size. Smaller companies in particular have fewer reserves to financially survive a data protection incident. A pragmatic, lean approach is therefore all the more important.

References

• Bitkom e.V. (February 2026): Data Protection in the German Economy—Study report on GDPR assessment by 603 companies. https://www.bitkom.org/Bitkom/Publikationen/Datenschutz-in-der-deutschen-Wirtschaft
• Bitkom e.V. (February 2026): Artificial Intelligence in Germany—Study on AI usage, barriers, and investments. https://www.bitkom.org/Bitkom/Publikationen/Kuenstliche-Intelligenz-in-Deutschland
• German Data Protection Conference (12.12.2025): Resolution on the regulation of artificial intelligence—demand for AI-specific GDPR adaptations. https://www.datenschutzkonferenz-online.de/entschliessungen.html
• European Data Protection Board (18.12.2024): Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
• EDPB (11.02.2026): Work Programme 2026-2027—Planned guidelines on generative AI, data scraping, and GDPR-AI Act interaction. https://www.edpb.europa.eu/system/files/2026-02/edpb_work-programme_2026-2027_en.pdf
• Ad-hoc-news.de (06.03.2026): Data protection authorities tighten pressure on AI projects in 2026—DSK strategy and DPIA obligations. https://www.ad-hoc-news.de/boerse/news/ueberblick/datenschuetzer-verschaerfen-2026-den-druck-auf-ki-projekte/68454427
• ADVISORI (March 2026): EU AI Act High-Risk—Obligations by August 2026 for companies. https://www.advisori.de/blog/eu-ai-act-hochrisiko-pflichten-august-2026