The GDPR is the European Union’s main data protection law. It sets rules for how organizations handle personal data about people in the EU. You need a lawful reason to use the data, people keep rights over their information, the data must be kept secure, and outside services that handle it for you need a contract with you. The law can apply even if your organization is based outside the EU. For example, a small charity in another country that keeps a mailing list of donors living in France may need to follow it.
Why it matters
Putting personal data into an AI tool counts as processing under the GDPR, so the same rules apply as for any other software. Donor names, client notes and staff records are all personal data. Before you paste them into a chatbot, check whether they include personally identifiable information. Ask the vendor whether they will sign a data processing agreement, and ask where your data will be stored (see data residency). The EU AI Act is a separate law with its own rules for AI.
Published Updated