Guides

Use AI. Protect data.

Guides for teams that use AI at work and want to protect personal data while doing so. With sources, checklists and direct answers.

Basics

Basics
Use AI at work without leaking company or personal data: 12 rules
Twelve rules for prompts, uploads and accounts, a never-paste list, a mask-first table by data type and a dated note on training defaults.
Basics
Where does your data go when you use ChatGPT, Copilot, Claude or Gemini?
Where ChatGPT, Copilot, Claude and Gemini data is processed and stored, what providers commit to, where it ends, and what you control. Dated table.
Basics
Pseudonymisation vs anonymisation under the GDPR: differences, examples and the CJEU ruling
Plain-English comparison with Art. 4(5), Recital 26 and the CJEU ruling C-413/23 P, three examples and what it means for AI prompts.
Basics
Shadow AI: detect, reduce and replace unsanctioned use
What shadow AI is, what German survey data says, why bans alone fail, where monitoring staff ends, and a 30-day plan with an owner for each step.

AI tools reviewed
Is ChatGPT GDPR compliant? Plans, DPA and what is left to do
It depends on plan, data and legal basis. Per-plan table (training, DPA, residency), what remains after the DPA, US transfers, EU checklist.
AI tools reviewed
ChatGPT, Microsoft Copilot, Claude and Gemini: privacy for business use compared
One dated table: training defaults, DPA, data location and quirks of four AI assistants, consumer vs business tiers, and how to choose.
AI tools reviewed
Microsoft Copilot and the GDPR: what applies, where the limits are and what to do before rollout
Microsoft 365 Copilot, Copilot Chat and consumer Copilot compared, EU Data Boundary and its two exceptions, oversharing, pre-rollout checklist.
AI tools reviewed
Claude and the GDPR: Free, Pro and Max compared with Team, Enterprise and the API
Claude at work: the training choice since 28 August 2025, five-year retention, the DPA in the Commercial Terms, residency options, a company checklist.

Practice and templates
How to anonymise data before ChatGPT (and why you are really pseudonymising)
Replace names, IBANs and addresses before the prompt and restore them in the answer: method, mapping table, worked example, checklist.
Practice and templates
AI acceptable use policy template for EU companies
Copy-ready AI acceptable use policy with approved tools, data classes with examples, works council note and the link to AI literacy under Article 4 AI Act.
Practice and templates
PII masking tools for AI chats: five approaches compared, with a buyer's checklist and a ten-sentence test
Manual placeholders, Presidio, gateway, browser extension, DLP compared by criteria, with a buyer's checklist and a ten-sentence test.
Practice and templates
PII redaction for LLM prompts: methods, limits and how to measure them
Pattern rules, NER, placeholders vs surrogates, gateways and on-device masking compared, plus a recipe to measure recall and what redaction cannot fix.

Law and regulation
EU AI Act: what duties do companies have that only use AI?
AI Act duties for deployers: timeline after Regulation (EU) 2026/1744, AI literacy, chat assistants, HR as high-risk, fines, GDPR alongside.
Law and regulation
DPIA for AI tools: when Article 35 GDPR applies, how to do one and what an outline looks like
DPIA for ChatGPT, Copilot and similar tools: trigger table, six-step procedure, outline with sample wording. Checked November 2026.
Law and regulation
Pasted personal data into ChatGPT by mistake: what to do now
Customer or staff data pasted into ChatGPT? First-hour steps, how a breach is assessed under Article 33 GDPR, and an incident note template.

Basics
Glossary: AI and data protection
AI and data protection terms from pseudonymisation to the AI Act, explained in short definitions with GDPR and AI Act article numbers and links to guides.