Running AI in the office in line with the GDPR: three options

Whether AI in the office can be run in line with the GDPR depends mainly on the contract with the provider and the place of processing, less on the individual model. Three options come into question: a cloud with a data centre in the EU, a German provider, or your own server. Each can be set up in line with data protection requirements, and none is so by itself. This article cannot give a guarantee. Your data protection officer or a lawyer assesses your individual case.

This concerns business offerings under a contract. Consumer chat services are not an option for client or project data; the article Shadow AI: when staff use private chat services explains why.

What applies to every option

As soon as a provider processes personal data on your behalf, such as names in emails, tenant data or minutes with attendee lists, it is generally a processor. Art. 28(1) GDPR permits only processors that provide sufficient guarantees. Under paragraph 3 a contract is required (more in the article Data processing agreements for AI services). Among other things it must provide that the provider acts only on your documented instructions, assures confidentiality and security measures, uses further sub-processors only under conditions, and deletes or returns the data when the service ends. The German Data Protection Conference (DSK) describes the case of cloud AI in the same way: there is often a processing relationship between provider and user, and an agreement under Art. 28(3) must be concluded.

The second question is training. The DSK asks you to check whether inputs and outputs are used to train the model, and calls applications that do not do so preferable. The third question is place: where is the data processed, where does it sit, and where may the provider transfer it?

Option 1: cloud with a data centre in the EU

As examples of large providers with EU options, I read the documentation of Microsoft (Azure models) and OpenAI (API platform). Both state there that your data is not used for training by default, and they differ in the details. The contract is what counts, and I have not checked it.

Microsoft says that inputs, outputs and embeddings (strings of numbers calculated from your texts for search) are not available to other customers and are not used to train foundation models without your instruction. With the “DataZone” deployment type in an EU member state, inputs may be processed in any EU member state, while stored data stays in the chosen region. For abuse monitoring, programs review samples of inputs and, where necessary, so do Microsoft staff, for models in the EEA staff in the EEA. Customers can apply to change this review. OpenAI says API data has not been used for training since 1 March 2023 unless you explicitly agree. Abuse monitoring logs are kept for up to 30 days by default. Data residency, that is the choice of region, can be set per project. Whether you are eligible is for OpenAI’s sales team to say, and for models released on or after 5 March 2026 it costs a 10 per cent uplift. Outside the US, OpenAI requires approval for abuse monitoring controls and an additional agreement on retention. System data, that is account and usage data without your content, may also be processed outside the chosen region.

The residual risk lies in US law. 18 U.S.C. § 2713 (CLOUD Act) obliges providers of electronic communication and remote computing services to preserve and disclose contents and customer records in their possession, custody or control, expressly regardless of whether they are located inside or outside the United States. On its wording, the provision therefore attaches to the provider and not to the storage location. That is my reading of the statutory text and not legal advice. How far it reaches in an individual case, for example with an EU subsidiary, is for a lawyer.

There is also the transfer to third countries. Under Art. 44 GDPR it is permitted only if the conditions of the chapter are met, for example through an adequacy decision under Art. 45. For the US there is Decision (EU) 2023/1795 on the Data Privacy Framework. The General Court dismissed the action against it on 3 September 2025 (T-553/23). The applicant lodged an appeal with the Court of Justice on 31 October 2025 (C-703/25 P). As of 13 November 2026 I have found no ruling. Anyone relying on this basis should know that it is still being challenged.

Option 2: German provider

As an example I read IONOS’s public documents. The product page for the AI Model Hub advertises hosting in Germany and that data is not used for training, and calls itself “100 % GDPR-compliant”. Those are advertising claims. The documentation and the contract documents are more reliable.

The documentation says: processing takes place in data centres in Germany. The content of inputs and outputs is not logged, not viewed by staff and not used for training. No sub-processors are used for the service, and operational data is accessed only from within the EU. The data centres are certified to ISO 27001, and according to the documentation the service falls within the scope of BSI C5. Contractually, the data protection package (version 7.4, dated June 2023) and the terms of use for AI services apply. Their clause 2.3 prohibits any use of inputs and outputs for training. It allows processing to improve the services only for software as a service, not for access to models through an interface, which is what the Hub offers. Functions in which you connect your own or third-party AI models are excluded. For those you alone are responsible.

The clauses are still worth reading. The data protection package permits processing in third countries where the service requires it, and further processors on the basis of a general authorisation. Objection is possible within 14 days and only for a material reason. The general data processing agreement for other IONOS products (version 1.4, dated October 2026) additionally allows, in clause 12.6, anonymising data and using it for product improvement. I did not find that clause in the data protection package. Contracts from the same provider therefore differ by product, and a product page does not replace the contract text.

A German provider does not spare you the contract review. Read the list of sub-processors and the exceptions for third countries. Ask for current evidence of any certifications you consider important. I checked the wording only of the IONOS documents named.

Option 3: own server

The DSK distinguishes closed and open systems. In a closed system, processing takes place in a confined, technically sealed environment, only a narrow group has access, and control over inputs and outputs rests with the users. The DSK calls such systems preferable from a data protection point of view. An own AI server can be one of them. In return you bear the duties yourself: access rights, security updates, logs, deletion, backup. In June 2025 the DSK published guidance on technical and organisational measures for developing and running AI systems, and in October 2025 guidance on systems that search your own documents (retrieval augmented generation). I have not evaluated their content for this article.

How to decide

Decide by data class, not across the board. General texts without personal data call for different requirements than tenant files, personnel records or health data. For specially protected data under Art. 9 GDPR, paragraph 1 sets a general ban on processing with narrow exceptions, as the DSK also writes. Removing names and addresses from an input is often not enough, because the link to a person can arise from the context. The DSK also points out that AI applications will often carry a high risk that triggers a data protection impact assessment under Art. 35 GDPR.

A cloud archive for invoices raises the question of place too: under the VAT Act, invoices are to be kept in Germany, and with electronic storage and online access also in the rest of the EU (more in the article Retaining e-invoices: data set, period and archive).

What you can do now

1. Write down which kinds of data already end up in AI tools in your business, split into data with and without personal reference.
2. Request in writing from every provider you consider: the data processing agreement, the list of sub-processors, and a statement on training and place of processing.
3. Ask your data protection officer or a lawyer whether an impact assessment is needed and whether the option holds for your data.
4. Set per data class which option is allowed, and record it in a short AI policy.