What if the AI tool gets the data from somewhere other than the person?

Article 14 applies when personal data was not obtained from the person, for example names and details pulled from a website, a list or another company. You give the same core information plus the categories of personal data (Article 14(1)(d)) and the source (Article 14(2)(f)), within a reasonable period and at the latest within one month (Article 14(3)(a)), or at the first contact if you use the data to communicate with them (Article 14(3)(b)).

Can I add a new AI use without updating the notice?

If you want to use data for a purpose other than the one you collected it for, Article 13(3) requires you to give people information on that other purpose before the further processing. Article 12(1) also requires the information to be concise, transparent, intelligible, easily accessible and in clear and plain language, so update the AI section rather than burying the change.

The AI section of your privacy notice: a GDPR Article 13 and 14 wording sheet for small businesses

Q: Do I have to mention AI tools in my privacy notice?

The GDPR does not ask you to use the word AI, but Article 13 requires you to tell people, when you collect their data, the purposes and legal basis of the processing, the recipients or categories of recipients, any transfer outside the EU, how long you keep the data and their rights. If a chatbot, transcription tool or writing assistant processes their personal data, those facts about that tool belong in the notice. Where you use automated decision-making covered by Article 22(1) and (4), Article 13(2)(f) also requires meaningful information about the logic involved and the significance and envisaged consequences.

Updated 22 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished AI section for your privacy notice: 10 fill-in lines per AI tool (what it does, what data goes in, purpose and legal basis, legitimate interest, supplier, transfers, retention, rights, whether people must use it, automated decisions), each tied to the GDPR article that requires it, plus an eight-line gap check you can tick before you publish. Made for small shops, agencies, clinics, trades and service businesses that added a chatbot, transcription tool or writing assistant.

The short answer

When you collect personal data, Article 13 GDPR requires you to tell people the purposes and legal basis, recipients, transfers outside the EU, retention, their rights and any automated decision-making covered by Article 22. If an AI tool processes that data, each of those facts applies to the tool, so the simplest fix is one short block per tool in your notice. Where the data did not come from the person, Article 14 adds the categories of data and the source. Article 12(1) requires all of it in clear and plain language and easy to reach.

The wording sheet (one block per AI tool)

Line	Fill-in wording	Rule
1. Tool and what it does	We use [tool type, e.g. a website chatbot / a call transcription tool / a writing assistant] to [answer questions / write call notes / draft replies].	Article 13(1)(c)
2. What data goes in	It processes [what you type or say to it / recordings of calls / your enquiry details].	Article 14(1)(d) if not collected from the person
3. Purpose and legal basis	We do this to [purpose], on the basis of [contract, Art 6(1)(b) / legitimate interests, Art 6(1)(f) / consent, Art 6(1)(a)].	Article 13(1)(c)
4. Legitimate interest (if used)	Our legitimate interest is [e.g. answering enquiries quickly outside office hours].	Article 13(1)(d)
5. Who receives it	The tool is provided by [supplier or category, e.g. a software supplier], which processes it on our instructions.	Article 13(1)(e)
6. Outside the EU	[Supplier] may process it in [country]. We rely on [adequacy decision / standard contractual clauses]; [how to get a copy].	Article 13(1)(f)
7. How long	We keep [chats / recordings / notes] for [period], then [delete them / keep only the summary].	Article 13(2)(a)
8. Your rights	You can ask for access, correction, erasure, restriction, objection and, where it applies, portability. [If consent: you can withdraw consent at any time.] You can complain to [supervisory authority].	Article 13(2)(b) to (d)
9. Must you give it?	You do not have to use the chatbot; you can [email / call] us instead.	Article 13(2)(e)
10. Automated decisions	[No decisions with legal or similarly significant effects are made by the tool alone.] OR [explain the logic, significance and consequences, and how to ask for a person].	Article 13(2)(f); Article 22

Example, filled in: We use a website chatbot to answer questions about orders. It processes what you type to it. We do this to answer your enquiry, on the basis of our legitimate interest in answering quickly outside office hours. The chatbot is provided by a software supplier that processes it on our instructions. We keep chats for 90 days, then delete them. You do not have to use the chatbot; you can email us instead. The chatbot does not make decisions about you.

Gap check before you publish

Check	Why	Done
Every AI tool that sees customer or staff data has a block	List from your AI register; include free tools staff use	Y / N
Purpose and legal basis are named per tool, not one line for all	Article 13(1)(c)	Y / N
Transfers outside the EU are named with the safeguard	Article 13(1)(f)	Y / N
A retention period or the rule for setting it is given	Article 13(2)(a)	Y / N
Automated decisions are either ruled out or explained	Article 13(2)(f)	Y / N
Data you did not collect from the person has a source line	Article 14(2)(f)	Y / N
The notice is reachable from the chatbot or form itself	Article 12(1): easily accessible	Y / N
Plain language: a customer can read the block in under a minute	Article 12(1)	Y / N

Do this week

List every AI tool that touches customer, client or staff data and write one block each
Read each supplier's terms for location, retention and use of your inputs, and fill lines 5 to 7 from them
Link the notice from the chatbot window, booking form or call script that collects the data
If you plan a new purpose for data you already hold, update the notice before you start (Article 13(3))
Pair the chatbot block with the AI Act chatbot disclosure, which is a separate duty

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 6, 12, 13, 14 and 22). National law and sector rules can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and agencies

If you look after small business clients, this is one sheet you can hand them alongside their client AI inventory. Stay inside your professional rules and refer legal questions on.

Keep each block next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep its notice block as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Regulation (EU) 2016/679 (GDPR): Articles 6, 12, 13, 14 and 22

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.