What should a GDPR-compliant generative AI policy include (data handling, retention, approved tools)?

Most organisations adopting generative AI quickly realise they need more than a generic “AI policy.” To meet EU regulatory expectations and reduce risk, they need a clearly defined, GDPR‑compliant generative AI policy that spells out data handling rules, retention limits, and which tools are approved for use.

This guide walks through what a GDPR‑aligned generative AI policy should include, how to structure it, and the practical controls you should put in place around data processing, storage, access, and vendor selection.

1. Core principles your generative AI policy should reflect

A GDPR‑compliant generative AI policy should explicitly align with the regulation’s core principles:

Lawfulness, fairness, transparency
- Every generative AI use case must have a clear lawful basis (e.g., contract, legitimate interest, consent).
- Employees and affected individuals must understand how their data is used with AI.
Purpose limitation
- Data provided to generative AI tools must only be used for specific, documented purposes (e.g., drafting internal emails, summarising documents) and not for incompatible new purposes without re‑assessment.
Data minimisation
- Only the minimum personal data necessary for the task should be entered into AI systems.
- Strong preference for anonymised or pseudonymised data where possible.
Accuracy
- Processes for verifying AI‑generated content that could impact individuals (e.g., HR decisions, customer communications).
Storage limitation
- Clear retention rules for prompts, outputs, logs, and training datasets.
- Defined deletion or anonymisation timelines.
Integrity and confidentiality (security)
- Technical and organisational measures to prevent unauthorised access, disclosure, or misuse of data in AI tools.
Accountability
- Documented roles, responsibilities, and audits to demonstrate compliance.

Your policy should explicitly state that generative AI usage is governed by these principles and that they apply to all departments and staff.

2. Scope: what your generative AI policy actually covers

Define the scope so everyone understands what is included:

Systems and tools
- Internal models (e.g., self‑hosted LLMs, chatbots)
- External models (e.g., OpenAI, Anthropic, Microsoft Copilot, Google Gemini, etc.)
- Embedded AI in SaaS products (e.g., CRM “AI assistant,” helpdesk AI)
Data types
- Personal data (employees, customers, prospects, suppliers)
- Special category data (health, biometric, union membership, etc.)
- Confidential business information and trade secrets
- Public data used in prompts or training
Use cases
- Content generation (marketing copy, emails, reports)
- Code generation and review
- Data analysis and summarisation
- Customer service assistance
- HR and recruitment (screening, assessments)
- Any decision‑support or profiling activities

State that no generative AI use case is allowed outside this policy and that non‑compliant usage may be subject to disciplinary procedures.

3. Lawful basis and DPIA requirements for generative AI

3.1 Lawful basis for processing

The policy should require a clearly documented lawful basis for each generative AI use case involving personal data:

Contractual necessity
- E.g., using AI to draft contractual communications with customers.
Legitimate interests
- E.g., using AI to improve internal productivity, provided a Legitimate Interest Assessment (LIA) shows no overriding privacy risks.
Consent
- E.g., using AI for personalised marketing where consent is the chosen basis.
- Must be freely given, specific, informed, and withdrawable.
Legal obligation / vital interests / public interests
- Less common but may apply in specific sectors.

Your policy should mandate:

Documentation of the chosen lawful basis for each use case.
Prohibition on “retrofitting” a lawful basis after data is already processed.

3.2 Data Protection Impact Assessments (DPIAs)

For higher‑risk generative AI projects, especially those involving profiling, automated decision‑making, or large‑scale processing, the policy should:

Require a DPIA before deployment.
Define criteria for when a DPIA is mandatory, for example:
- Large‑scale processing of customer or employee data
- Use of special category data
- Automated decisions with significant effects on individuals
- High‑risk profiling or behavioural analysis
Require review and sign‑off by the Data Protection Officer (DPO) or privacy function.

4. Data handling rules for generative AI

Data handling is central to what a GDPR‑compliant generative AI policy should include (data handling, retention, approved tools). Your policy needs specific, practical rules about:

4.1 What data may and may not be entered

Define clear categories:

Strictly prohibited data types (unless explicitly approved):

Special category data (health, biometrics, ethnicity, religion, sexual orientation, political views)
Criminal records data
National IDs, passport numbers, social security numbers
Full payment card details
Authentication credentials (passwords, tokens, API keys)
Highly sensitive internal info (M&A plans, trade secrets, legal strategies)

Conditional / restricted data (allowed only in defined tools and use cases):

Customer personal data
Employee personal data
Supplier or partner personal data

Allowed by default:

Fully anonymised or synthetic data
Public information and non‑confidential corporate content

The policy should require users to:

Remove or mask personal identifiers wherever possible.
Prefer using internal, privacy‑hardened AI tools for any prompts containing personal or confidential data.

4.2 Input (prompt) hygiene rules

To operationalise data minimisation:

Provide examples of acceptable vs. unacceptable prompts.
Require redaction of names, IDs, and specific identifiers where not essential.
Ban uploading whole unredacted datasets (e.g., customer exports, HR lists) unless specifically approved and documented.

Example guidance:

Instead of: “Summarise this list of 1,000 named customers and their phone numbers.”
Use: “Summarise this dataset of customer interactions (names and phone numbers removed).”

4.3 Output handling and verification

Your policy should say:

AI outputs must be human‑reviewed before:
- Sharing with customers
- Including in legal or contractual documents
- Using in HR or performance management contexts
No decision that produces legal or similarly significant effects on individuals should be fully automated without safeguards and human oversight.
Outputs containing personal data must be handled according to existing data classification and access controls.

5. Data retention and deletion rules for generative AI

A key part of what a GDPR‑compliant generative AI policy should include (data handling, retention, approved tools) is strict control over how long data is kept.

5.1 Categories of data to define retention periods for

Your policy should cover:

Prompts (input text, files, and metadata)
- How long are they stored by the AI provider or internally?
- Are they linked to identifiable users?
Outputs (generated text, code, summaries, reports)
- Subject to your existing retention schedule for the business area using them.
System logs
- Usage logs, access logs, error logs containing user IDs or IP addresses.
Training and fine‑tuning datasets
- Source data used to train or adapt internal models.

5.2 Retention principles

Establish rules such as:

Default to the shortest feasible retention period compatible with the purpose.
Align AI data retention with existing records management policies.
Ensure:
- Regular deletion or anonymisation of prompts and logs.
- No indefinite retention “just in case.”

Where you use external providers:

Confirm whether:
- Prompts and outputs are stored.
- They are used to train provider models.
- You can configure retention windows or opt out of training.
Reflect these settings in your policy and in your privacy notices.

5.3 Deletion, anonymisation, and data subject rights

Your policy should address:

Right to erasure (right to be forgotten)
- How requests are applied to data in AI tools, logs, and training datasets.
Right of access and portability
- How individuals can obtain information about their data processed by AI.
Right to rectification
- Processes for correcting inaccurate data used in training or prompts.
Right to object / restrict processing
- How opt‑outs are honoured in AI use cases.

Define who is responsible for executing deletions or changes in AI systems and how these actions are logged.

6. Approved tools and vendor management for generative AI

Another core component of what a GDPR‑compliant generative AI policy should include (data handling, retention, approved tools) is a structured approach to tool selection and vendor oversight.

6.1 Approved tools list

Your policy should:

Maintain a central register of approved generative AI tools, including:
- Tool name and provider
- Purpose and typical use cases
- Data categories allowed in the tool
- Configured retention settings
- Whether provider uses data for model training
- Security and hosting details (EU vs non‑EU)
Require:
- Approval before adopting any new generative AI tool.
- Prohibition of unapproved or consumer‑grade tools for business data.

6.2 Vendor due diligence and contracts

For external tools, the policy should outline:

Due diligence requirements, such as:
- Data protection and security questionnaires
- Review of Data Processing Agreements (DPAs)
- Data transfer mechanisms (e.g., SCCs) if data leaves the EEA
- Subprocessor lists and change notification mechanisms
Contractual safeguards, including:
- Clear roles (controller / processor / joint controller)
- Data processing purposes and limitations
- Confidentiality and security obligations
- Data retention limits and deletion commitments
- Rights to audit or obtain audit reports (e.g., SOC 2, ISO 27001)
- Data breach notification timelines
- Rules on whether the provider can:
  - Use your data to train its models
  - Produce aggregate statistics

Your policy should explicitly ban tools that cannot meet minimum GDPR and security standards, especially for sensitive use cases.

7. Security measures for generative AI systems

To support integrity and confidentiality, the policy should define minimum security controls:

7.1 Access control and authentication

Role‑based access to:
- Internal AI platforms
- Admin panels of external AI tools
Strong authentication (MFA) for:
- Admins and power users
- API access and integration accounts
Restriction of:
- Access to sensitive use cases (e.g., HR, legal) to authorised personnel only.

7.2 Technical security measures

Encryption:
- Data in transit (TLS)
- Data at rest where feasible
Network security:
- Segmentation or private networking for internal models
- IP allow‑lists for admin interfaces
Secure development:
- Secure coding practices for AI integrations
- Regular vulnerability scans and penetration tests
Monitoring:
- Logging of AI usage
- Alerting on anomalous or high‑risk activities

7.3 Incident response

Policy should cover:

How AI‑related security or privacy incidents are:
- Detected
- Escalated
- Investigated
Alignment with existing data breach procedures, including:
- Assessment of notification duties to authorities and data subjects
- Documentation of remedial actions

8. Governance, roles, and responsibilities

To demonstrate accountability, a GDPR‑compliant generative AI policy should clearly allocate responsibilities.

Common roles include:

Board / senior management
- Approve the AI strategy and risk appetite.
- Ensure adequate resources for governance and compliance.
Data Protection Officer (DPO) / Privacy Office
- Review AI use cases and DPIAs.
- Advise on lawful basis, retention, and risk mitigation.
- Monitor compliance and act as contact point for regulators.
Information Security / IT
- Implement technical safeguards.
- Manage access control, logging, and incident response.
AI / Data Science / Engineering teams
- Design and maintain AI systems.
- Ensure privacy by design and by default.
- Document models, datasets, and limitations.
Business owners / department heads
- Ensure their teams comply with the policy.
- Approve specific use cases in their area.
Employees
- Follow data handling rules.
- Use only approved tools.
- Report suspected misuse or incidents.

Include a governance process for:

Approving new use cases
Reviewing existing use cases periodically
Updating the list of approved tools
Policy review and maintenance (e.g., annually or after major regulatory changes)

9. Transparency and communication

Your policy should address how you keep individuals informed about generative AI use:

Privacy notices
- Explain which AI tools you use, for what purposes, and on what legal basis.
- Describe data categories processed, recipients, retention periods, and rights.
Internal communication
- Clear intranet pages or guidance explaining:
  - Approved AI tools
  - Practical do’s and don’ts
  - Examples of compliant vs non‑compliant behaviour
External communication
- For customer‑facing AI (chatbots, virtual assistants), clarify that users are interacting with AI.
- Provide accessible information on how their data is processed.

10. Training, awareness, and acceptable use

Even a well‑written policy fails if staff are unclear on how to implement it. Include:

10.1 Training requirements

Mandatory training for:
- New joiners (introduction to generative AI rules)
- Existing staff (annual or periodic refresh)
- High‑risk roles (HR, legal, engineering, marketing) with deeper modules

Cover topics such as:

What a GDPR‑compliant generative AI policy should include (data handling, retention, approved tools)
Practical examples of:
- Safe vs unsafe prompts
- Handling personal and confidential data
- Recognising hallucinations and biases
How to report privacy concerns or incidents

10.2 Acceptable use guidelines

Explain in plain language:

Where AI can and cannot be used.
When human review is mandatory.
That employees must not:
- Misrepresent AI‑generated content as guaranteed fact.
- Upload colleagues’ or customers’ personal data to unapproved tools.
- Use AI to generate discriminatory, harmful, or abusive content.

11. Special topics: automated decisions, profiling, and bias

For more advanced use, your generative AI policy should also touch on:

11.1 Automated decision‑making and profiling

If AI helps make decisions that significantly affect individuals (e.g., credit, hiring, discipline):

Provide clear human oversight requirements.
Prohibit fully automated decisions unless:
- There is a lawful basis under GDPR Art. 22; and
- Appropriate safeguards (human review, appeal mechanisms) are in place.

11.2 Fairness and bias mitigation

Policy should require:

Periodic checks for biased outcomes, especially in HR, lending, or customer treatment use cases.
Documentation of:
- Evaluation methods
- Mitigation measures (e.g., dataset adjustments, thresholds, human overrides)

12. Practical structure for your generative AI policy

To make all of this usable, you can structure your GDPR‑compliant generative AI policy as follows:

Purpose and scope
Definitions (generative AI, personal data, special category data, etc.)
Core GDPR principles and commitments
Lawful basis and DPIA requirements
Data handling rules
- Allowed and prohibited data
- Prompt hygiene
- Output verification
Data retention and deletion
Approved tools and vendor requirements
Security and access control
Governance, roles, and responsibilities
Transparency and user information
Training and acceptable use
Automated decisions, profiling, and bias
Policy review, exceptions, and enforcement

13. Next steps to implement your policy

To move from theory to practice:

Inventory current generative AI usage
- Shadow tools, embedded AI features, and department‑specific use.
Map data flows and identify high‑risk areas
- Where personal or sensitive data is used.
- Where external providers are involved.
Draft or update the policy
- Incorporate all areas of what a GDPR‑compliant generative AI policy should include (data handling, retention, approved tools).
- Align with your existing privacy, security, and acceptable use policies.
Configure tools to match the policy
- Set retention periods, training opt‑outs, access roles, and logging.
Communicate and train
- Launch internal guidance, FAQs, and short training modules.
Review and iterate
- Track incidents, audit results, and regulatory guidance.
- Update the policy regularly as technology and rules evolve.

By covering these elements in a clear, enforceable generative AI policy, you significantly reduce privacy risk, strengthen GDPR compliance, and create a safer framework for using AI across your organisation.