Before you start: what we are talking about
The GDPR is the European regulation on the protection of personal data. It applies to businesses established in the European Union, and to those that process data of people located there. The FADP (nLPD) is the Swiss data protection law. A business in the Jura, Basel or Alsace that works with customers on both sides of the border may be covered by both.
Using AI does not change the nature of your obligations: you remain responsible for the data you process. What changes is that new data starts to flow, often to new providers. That is where you need to look closely.
What follows is a practical checklist, not a legal opinion. The rules change and how they apply depends on your situation. For an answer tailored to you, consult the resources of the CNIL (the French data protection authority) in France or of the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or a legal professional.
The checks to carry out
Take each use of AI separately (sorting emails, preparing quotes, reading documents) and run it through the following questions.
What data are you sending?
List exactly what the tool receives: the full text of emails, attachments, names and contact details, order numbers, health or payroll information. Some categories of data are more sensitive than others and call for particular care. If you do not know what is being sent, that is the first thing to clear up.
Minimise
Only send what the task needs. To sort an email, the tool does not always need the attachments. To prepare a quote, it does not need the customer’s full history. Removing or masking unnecessary data reduces the risks without harming the result.
Who processes the data?
Identify each provider: the AI model provider, the hosting company, the integrator. Each one generally acts as a processor on your behalf. Check that a contract covers this processing, what the provider is allowed to do with the data, and whether it reuses it to train its own models.
Where is it hosted?
Ask which countries the data is stored and processed in. A transfer outside the European Union or outside Switzerland is subject to specific rules. Where possible, hosting in Europe often makes things simpler.
How long is it kept?
Find out how long each provider keeps the data, and set your own retention period. Data that is no longer needed should be deleted.
Inform, document, secure
Technical checks are not enough. A few internal steps complete the picture.
- Inform the people concerned: update your privacy policy to mention the use of AI tools and the providers involved.
- Keep your record of processing activities up to date: add each new use, its purpose, the data concerned and the recipients.
- Limit access: only the people who need them can access the tools and the data.
- Keep a person in the loop: a decision that affects someone (a refusal, a sanction, an individual price) should not be left to the tool alone.
- Plan what to do if something goes wrong: who to notify, and how.
- Train your team: everyone should know what they may and may not paste into a consumer AI tool.
A common trap: consumer tools
The risk does not always come from a structured project. It often comes from an employee who copies a customer email, a contract or a price list into a free online assistant to save time. Nobody has checked the terms of use, or where that data goes.
It is better to set a simple rule and share it: which tools are allowed, for which uses, and which data must never be entered into them. This is often the most useful measure, and the cheapest.
How we work
When we set up an AI assistant or an automation, we start from these same questions. Only the necessary data is sent, hosting is chosen with you, including in Europe, and you keep ownership of your data and your access. Actions that commit the business, such as sending an email, a quote or an invoice, go through human approval.
We help you document data flows for your record of processing and your privacy policy. However, we do not replace legal advice: for any question of interpretation, we will point you to the CNIL, the FDPIC or your adviser.