Reusing customer emails, chats and call notes in AI tools: a GDPR Article 6(4) compatibility check sheet for small businesses
What you get: a finished Article 6(4) reuse check sheet in three tabs: a reuse log with one row for each time you want to put existing customer data into an AI tool for a new purpose, a five-factor tab with the five questions Article 6(4) GDPR lists and a formula that sorts each row into "stop", "get consent or rework", "review" or "likely compatible: tell people first", and a before-you-start tab that records the notice you must give before the new use, plus four made-up example rows.
Short answer: personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" (Article 5(1)(b) GDPR). When a new use is not based on consent or on a law, Article 6(4) says you "shall" take into account, among other things: the link between the purposes, the context of collection and your relationship with the people, the nature of the data (in particular Article 9 and 10 data), the possible consequences for them, and safeguards such as encryption or pseudonymisation. And before the new use starts you must tell people about the other purpose (Articles 13(3) and 14(4)).
Why AI tools make this come up
A small business already holds years of support emails, chat logs, call notes and order history. New AI tools make it tempting to reuse them: paste old tickets into a chatbot's knowledge base, feed past sales emails to an AI writing tool, or let a vendor use your customer chats to improve its model. Each of these is a use for a purpose other than the one the data was collected for. The EDPB names Article 6(4) as a provision that "may be relevant in the context of the development and deployment of AI models" (Opinion 28/2024, para. 17), and says that the different stages of developing or deploying a model "may constitute the same or different processing activities" (para. 64).
Step 1: tab 1, reuse log (one row per planned reuse)
| Column | What to write | Source |
|---|---|---|
| A. Reuse ref | R1, R2 and so on | |
| B. Data set | For example "support emails 2023 to 2025", "chatbot logs", "call recordings" | |
| C. Original purpose | Copy it from your privacy notice or record of processing, word for word | Art. 5(1)(b); Art. 13(1)(c) |
| D. Original legal basis | Contract, legal obligation, legitimate interest or consent | Art. 6(1) |
| E. New purpose | What the AI tool will do with it, in one sentence. "Improve AI" is too vague: name the tool and the output | Art. 5(1)(b) "specified, explicit"; EDPB Opinion 28/2024 para. 64 |
| F. Will you ask for consent for the new purpose? | Yes or No. If Yes, the compatibility test is not the route: record the consent instead | Art. 6(4) opening words; Recital 50 |
| G. Does the AI vendor use the data for its own purposes (for example training its model)? | Yes, No or Don't know. Check the vendor's terms and your processor agreement | Our working rule; see the Article 28 processor agreement sheet |
Step 2: tab 2, the five factors from Article 6(4)
Answer each factor "Low", "Medium" or "High" concern, and write one line of reasons next to it. The factor wording is from Article 6(4)(a) to (e); the questions in the middle column are ours.
| Column | Question to answer | Source |
|---|---|---|
| H. (a) Link between purposes | Is the new purpose close to the old one (answering the same customers' questions faster) or unrelated (building a sales profile from support chats)? | Art. 6(4)(a) |
| I. (b) Context and relationship | Would your customers reasonably expect this use, given how and why they gave you the data? Did they give it to you directly, or did it come from someone else? | Art. 6(4)(b); Recital 50 "reasonable expectations"; EDPB Opinion 28/2024 paras. 93, 94 |
| J. (c) Nature of the data | Does the data set contain health, beliefs, or other Article 9 data, or criminal convictions data (Article 10)? Answer Yes or No in its own column | Art. 6(4)(c); see the Article 9 check sheet |
| K. (d) Possible consequences | Could the new use change how a person is treated, expose their messages to others, or end up in a vendor's model? | Art. 6(4)(d) |
| L. (e) Safeguards | Names and contact details removed or replaced (pseudonymisation), encryption, vendor training switched off, access limited. "Low" concern means strong safeguards | Art. 6(4)(e) |
| M. Result | =IF(Tab1!F2="Yes","Consent route: record consent, no 6(4) test",IF(J2="Yes","Stop: Article 9/10 data, get advice",IF(COUNTIF(H2:L2,"High")>=2,"Get consent or rework the plan",IF(OR(COUNTIF(H2:L2,"High")=1,Tab1!G2<>"No"),"Review: write down why it is compatible","Likely compatible: tell people first (tab 3)")))) | Formula and thresholds are our working rule, not a legal test |
For column J, write Yes or No; for H, I, K and L, write Low, Medium or High. A note from the EDPB on expectations: mentioning a use in your privacy policy "does not necessarily mean that the data subjects can reasonably expect it to happen" (Opinion 28/2024, para. 92), so a line in the notice does not turn a High in column I into a Low.
Step 3: tab 3, before you start
| Column | What to write | Source |
|---|---|---|
| A. Reuse ref | From tab 1 | |
| B. Notice of the new purpose given on | Date, and where (email, account page, updated notice). Must be before the new use starts | Art. 13(3) and Art. 14(4): "prior to that further processing" |
| C. Right to object mentioned? | Yes or No | Recital 50: information on the other purposes and the right to object "should be ensured" |
| D. Start date of the new use | Must be on or after column B. =IF(D2<B2,"Too early: notice first","OK") | Art. 13(3); check is our working rule |
| E. Fields removed before reuse | For example names, emails, phone numbers, order numbers | Art. 5(1)(c) data minimisation; Art. 6(4)(e) |
| F. DPIA needed? | Run the DPIA screening sheet and paste the answer | Art. 35 |
| G. Reviewed on and by | Date and role (not a private name if you share the sheet) | Art. 5(2) accountability |
Four made-up example rows
| Planned reuse | Result | What happened |
|---|---|---|
| Bike shop puts 2 years of repair-question emails, names removed, into its own website chatbot so it can answer the same kind of questions | Likely compatible: tell people first | Notice added to the account page and order emails 3 weeks before go-live, with the right to object; vendor training switched off |
| Physiotherapy practice wants an AI tool to draft marketing emails from appointment notes | Stop: Article 9/10 data | Health data; plan dropped, marketing written from public service descriptions instead |
| Web agency wants to score leads from old support chats to find upsell targets | Get consent or rework the plan | Link (a) High and expectations (b) High; agency asked customers to opt in instead |
| Accounting firm's AI note-taker vendor wants to use call transcripts to train its model; terms unclear | Review | Column G "Don't know"; firm asked the vendor in writing and switched training off in settings |
These rows are made up for illustration and do not describe any real business.
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5(1)(b), 6(4), 13(3), 14(4) and Recital 50, as published on gdpr-info.eu) and EDPB Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, adopted 17 December 2024 (paras. 17, 64, 92 to 94). The EDPB opinion leaves the application of Article 6(4) to AI models for supervisory authorities to assess case by case. The questions, Low/Medium/High scale, result formula and thresholds are our own working rules. Article 6(4) also does not apply where the further use is based on a law that meets Article 23(1); check your data protection authority's guidance. Checked on 27 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients are already pasting customer files into AI tools. Send them tab 1 with the client AI inventory: one row per reuse shows quickly which plans need a notice and which need consent. Stay inside your professional rules and refer legal questions on.
Keep the reuse decisions next to your AI tool list
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, then attach this sheet as the evidence record for the reuse it covers.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: legitimate interest assessment · Article 13 privacy notice AI section · retention schedule for chat logs · Article 17 and 21 requests
Sources
- Article 5 GDPR, Article 6 GDPR, Article 13 GDPR, Article 14 GDPR and Recital 50; official text: Regulation (EU) 2016/679
- EDPB Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (paras. 17, 64, 92 to 94)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.