What does GDPR Article 25 actually require?

Article 25(1) requires the controller, both when deciding the means of processing and during the processing itself, to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement data-protection principles such as data minimisation in an effective manner. Article 25(2) requires measures ensuring that, by default, only personal data necessary for each specific purpose are processed. That applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.

Does Article 25 apply to a small business that only uses an AI tool?

Article 25 is addressed to the controller: the business that decides why and how personal data are processed. If you choose an AI tool and decide what client or staff data goes into it, the duty to pick appropriate settings is yours. Recital 78 adds that producers of applications and services should be encouraged to design them so that controllers can meet their obligations, but the Article itself places the duty on you as controller.

What does 'not made accessible to an indefinite number of people' mean for AI tools?

Article 25(2) says that, in particular, the measures must ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. For an AI tool, check settings such as public or 'anyone with the link' sharing of chats, workspace-wide visibility of uploads and transcripts, and anything published from the tool, and choose the narrowest setting that still does the job.

Privacy by default for your AI tools: a GDPR Article 25 settings sheet for small businesses

Updated 23 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished privacy-by-default settings sheet for your AI tools: 10 columns, one row per tool (the data the task needs, what actually goes in, training on your inputs, history period, share links, connected apps, who sees results, less identifying input, and the setting you chose with a date and reason), each tied to the GDPR rule behind it, plus an eight-line fix list. Made for small shops, agencies, clinics, trades and service businesses where staff use chat assistants, writing tools, transcription or email helpers with client data.

The short answer

Article 25(2) GDPR requires the controller to ensure that, by default, only personal data necessary for each specific purpose are processed, covering the amount collected, the extent of processing, the storage period and who can access the data. Article 25(1) asks for measures, such as pseudonymisation, that put principles like data minimisation into practice, both when you choose a tool and while you use it. GDPR does not list settings per product, so the practical step is one row per AI tool comparing what the task needs with what the tool takes by default, and recording the setting you chose and why.

The sheet (one row per AI tool)

Column	Fill in	Why
A. Tool and purpose	[Tool name, plan] · used for [one specific task, e.g. drafting replies to customer emails]	Article 5(1)(b): specified purpose; Article 25(2) works per purpose
B. Personal data the task needs	[e.g. customer first name and question only]	Article 5(1)(c) data minimisation; Article 25(2) amount collected
C. What goes in today	[e.g. whole email thread incl. signature, phone, order history]; extra data not needed: Y / N	Shows the gap between B and real use
D. Training on your inputs	Setting offered by the tool: [on / off / not offered / not stated]; chosen: [..]	Article 25(2) extent of processing; Article 5(1)(b) purpose
E. Chat and file history	Default period: [..]; chosen: [off / x days / manual delete]	Article 25(2) period of storage; Article 5(1)(e) storage limitation
F. Sharing and links	Default: [private / workspace / anyone with link]; chosen: [..]	Article 25(2): not accessible to an indefinite number of people
G. Connected apps	Mailbox, drive, calendar, CRM connected: [list]; access limited to [folders / labels / none]	Article 25(2) amount and extent; connect only what the task needs
H. Who can see results	[only the user / named team / whole workspace]	Article 25(2) accessibility
I. Less identifying input	Can staff use initials, a case number or remove names before pasting? [Y / N, how]	Article 25(1) names pseudonymisation as an example measure
J. Decision and review	Setting chosen because [..]; set on [date] by [role]; recheck after each plan change or new feature; next check [date]	Article 25(1): at the time of choosing the means and during the processing; Article 5(2) accountability

Example row, made up: A. Writing assistant, team plan, drafting replies to customer emails · B. Customer first name and the question · C. Staff paste the full thread incl. signature and phone number: extra data Y · D. Training on inputs: switch offered, chosen off · E. History default unlimited; chosen 30 days · F. Share links: chosen private · G. No mailbox connected · H. Only the user · I. Staff remove signature block before pasting: Y · J. Chosen 23 Oct by office manager because replies need no history; next check 23 Jan.

Eight-line fix list

If you find	Do this	Fixed
Column C holds more than column B	Write a pasting rule: only the data in B, or trim it before pasting	Y / N
Training on your inputs is on and the tool offers a switch	Decide whether that purpose is needed; if not, switch it off and note the date	Y / N
Training setting not stated anywhere	Ask the supplier in writing and keep the answer	Y / N
History kept with no end date	Pick a period that fits the task, or delete by hand on a fixed day	Y / N
Share links open to anyone	Change to private or named people; check old links	Y / N
Whole mailbox or drive connected for one small task	Limit to the folder or label the task needs, or disconnect	Y / N
Results visible to the whole workspace	Narrow to the people who need them	Y / N
No date or reason in column J	Fill it today and put the next check in the diary	Y / N

Do this week

Add one row per AI tool, including free accounts staff opened themselves
Write column B before you look at the settings: what does this one task really need?
Open each tool's privacy, data and sharing settings and the supplier's help pages, and fill D to H with what you find; write "not stated" rather than guess
Fill column J with the setting you chose, the reason and the date
Match column E with your retention schedule and column H with your access and security sheet

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5 and 25, Recital 78). Which measures are appropriate depends on the state of the art, cost and the risks of your processing; national law and sector rules can add obligations. Tool settings change: recheck after plan changes and new features. Checked on 23 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

If you look after small business clients, this is a one-page sheet you can hand them next to their client AI inventory, and you can fill it for your own practice's AI tools too. Stay inside your professional rules and refer legal questions on.

Keep each row next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep its settings row and decision as evidence records.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Regulation (EU) 2016/679 (GDPR): Articles 5(1)(b), (c), (e) and 5(2), Article 25(1) and (2), Recital 78

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.