Does GDPR say which security settings an AI tool must have?

No. Article 32(1) requires the controller and the processor to put in place technical and organisational measures that give a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk to people. It lists examples, as appropriate: pseudonymisation and encryption; the ongoing confidentiality, integrity, availability and resilience of systems; the ability to restore availability and access to data in a timely manner after an incident; and a process for regularly testing, assessing and evaluating the measures. You decide what is appropriate for each tool and write down why.

What risks should I think about for an AI account?

Article 32(2) says that in assessing the appropriate level of security you take account in particular of the risks from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. For an AI tool that usually means: a former employee still signed in, a shared login nobody controls, chat history full of client details visible to the whole team, and no copy of records you need if the account is closed.

Do staff need instructions before using AI tools with personal data?

Article 32(4) requires the controller and processor to take steps to ensure that any person acting under their authority who has access to personal data does not process it except on instructions from the controller, unless Union or Member State law requires it. Article 29 says the same for the processor and anyone acting under the authority of the controller or processor. A short written instruction per tool (what data may go in, what may not) is a simple way to show this.

Who can see what in your AI tools: a GDPR Article 32 access and security sheet for small businesses

Updated 23 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished access and security sheet for your AI tools: 10 columns, one row per AI account (personal data that goes in, who has access, sign-in protection, owner and admins, leavers, saved chats, export and restore, staff instruction, review date), each tied to the GDPR rule behind it, plus an eight-line fix list you can work through in an afternoon. Made for small shops, agencies, clinics, trades and service businesses where staff use chat assistants, transcription tools or writing tools with client data.

The short answer

Article 5(1)(f) GDPR requires personal data to be processed with appropriate security, including protection against unauthorised processing and accidental loss, and Article 5(2) makes you responsible for being able to show it. Article 32 turns that into measures appropriate to the risk, with examples such as encryption, confidentiality of systems, the ability to restore access after an incident and regular testing. GDPR does not list settings per tool, so the practical step is one row per AI account showing who can get in, what they can see, how you get data back, what staff were told, and when you last checked.

The sheet (one row per AI tool account)

Column	Fill in	Why
A. Tool and plan	[Tool name] · [free / paid / business plan] · used for [task]	Lists what you are securing
B. Personal data that goes in	[client names / emails / call recordings / staff data / none]	Sets the risk level, Article 32(1) and (2)
C. Who has access (names)	[names or roles]; each person has their own login: Y / N	Confidentiality; shared logins hide who did what
D. Sign-in protection	Two-step sign-in or company single sign-on switched on for every user: Y / N	Unauthorised access, Article 32(2)
E. Admin and owner	Account owner: [role, company email, not a personal address]; admins: [names]	Someone can remove access and close the account
F. Leavers	Removed on last working day by [role]; last check: [date]	Unauthorised access by former staff
G. Saved chats and files	Who can see past chats, uploads and transcripts: [only the user / whole team / admins]; history kept for [period]	Unauthorised disclosure; pair with your retention schedule
H. Export and restore	Can you export the records you need? [Y / N, how]; copy kept at [place]	Article 32(1)(c): restore availability and access in a timely manner
I. Staff instruction	Written rule: what may go in [..], what must not [..]; given to staff on [date]	Article 32(4) and Article 29
J. Review	Last checked [date] by [role]; next check [date]	Article 32(1)(d) regular testing; Article 24(1) review and update

Example row, filled in: A. Transcription tool, business plan, used for client call notes · B. Client names and call recordings · C. Two advisers, own logins: Y · D. Two-step sign-in on for both: Y · E. Owner: office manager, company address; admin: office manager · F. Leavers removed on last day by office manager; last check 1 Oct · G. Each adviser sees only their own calls; recordings kept 30 days · H. Notes exported to the client file after each call · I. Rule: no health details, no bank details; sent 1 Oct · J. Next check 1 Jan.

Eight-line fix list

If you find	Do this	Fixed
Any tool with client or staff data on a shared login	Give each person their own account or stop putting personal data in it	Y / N
Any user without two-step sign-in	Switch it on today where the tool offers it	Y / N
Any former employee or contractor still listed	Remove access and note the date in column F	Y / N
Account owned by a personal email address	Move ownership to a company address	Y / N
Chat history visible to the whole team with client details in it	Restrict sharing or shorten the history period	Y / N
No written rule on what may be pasted in	Write two lines per tool and send them to staff	Y / N
No way to get records out if the supplier closes the account	Note an export route or keep the source record elsewhere	Y / N
No review date	Put one in the diary, for example every three months	Y / N

Do this week

Take your list of AI tools and add one row per account, including free accounts staff opened themselves
Fill columns C to F from each tool's user or admin settings page
Check the supplier's help pages for history, sharing and export options and fill G and H
Write the two-line staff rule per tool (column I) and send it
If something does go wrong, use the 72-hour breach sheet: Article 33 sets the clock

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5, 24, 29, 32 and 33). Which measures are appropriate depends on your risk; national law and sector rules can add obligations. Checked on 23 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

If you look after small business clients, this is a one-page sheet you can hand them next to their client AI inventory, and you can use it for your own practice's AI accounts too. Stay inside your professional rules and refer legal questions on.

Keep each row next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep its access row and staff rule as evidence records.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Regulation (EU) 2016/679 (GDPR): Articles 5(1)(f) and 5(2), 24(1), 29, 32 and 33

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.