AI & GDPR: The 10-Point Checklist for SMEs
AI & GDPR: What SMEs Need to Watch
Every AI application that processes personal data is subject to GDPR. This checklist helps with practical implementation.
The 10-Point Checklist
1. Is your record of processing activities up to date? Every AI application must be documented in the ROPA — purpose, legal basis, retention period, recipients.
2. Is the legal basis clarified? Art. 6 GDPR: consent, contract, legitimate interest, or legal obligation — which applies?
3. Data principle: local before cloud Personal data should preferably be processed on EU servers. Third-country transfer = SCCs required.
4. Is a deletion concept defined? AI models can “memorise” data. How are training data and inference logs deleted?
5. Was a DPIA carried out? A data protection impact assessment is mandatory for high-risk processing (Art. 35).
6. Is the right of access technically feasible? Data subjects can request access, deletion, and portability — is that possible in your system?
7. Is a data processing agreement in place? A DPA is required with every AI provider (even within the EU).
8. Are automated decisions documented? Art. 22 GDPR: fully automated decisions with legal effect require the possibility of human review.
9. Are AI literacy trainings verifiable? Since Feb. 2026: EU AI Act Art. 4 training obligation. Must be documented.
10. Is there an incident response plan? A data breach triggers a 72h reporting obligation. Is the process defined and tested?
How IIO Automatically Meets the Checklist
IIO customers get all 10 points as automated workflows — no manual effort.
Configure your data protection package →
The 7-Point Checklist for GDPR-Compliant AI
1. Document the legal basis Every AI processing operation needs a legal basis (Art. 6 GDPR). For employee data: consent or legitimate interest with a balancing test.
2. Respect purpose limitation AI may only use data for the stated purpose. No “we’re also training our model on the side” without explicit consent.
3. Data minimisation Only process the data necessary for the AI function. Personal attributes that aren’t needed → don’t include them.
4. Flag automated decisions (Art. 22) Fully automated decisions with legal effect are prohibited in principle — except with explicit consent or for contract performance.
5. Implement data subject rights technically Access, deletion, portability: these rights must be technically feasible for AI-processed data too — not just handled by email.
6. Data protection impact assessment (DPIA) For high-risk processing (e.g. profiling of employees), a DPIA is mandatory.
7. Data processing agreement (DPA) A DPA is required for every AI service from an external provider. Check: where is the data processed? EU servers or a third country?
Local AI as a GDPR Solution
Local language models (Ollama, llama.cpp) on EU servers eliminate the third-country problem entirely. No data leaves the company. IIO AI Hub →
More on GDPR-compliant AI infrastructure →
Next step: Configure your package or talk to us.