Artificial intelligence can help companies analyze documents, automate customer service, summarize records, and make everyday work more efficient. But using AI also raises important questions about personal information, healthcare records, automated decisions, and regulatory compliance.
Understanding GDPR, HIPAA, and related data protection requirements can help businesses adopt AI more responsibly. The key is to assess the information being processed, the purpose of the AI system, the applicable laws, and the safeguards in place.
Quick answer: Businesses can use AI while meeting applicable privacy requirements, but compliance requires more than selecting a well-known AI provider. Organizations must assess their legal obligations, choose appropriate tools, control access to information, manage vendors, document risks, and monitor how AI is used.
1. What does AI compliance mean for a business?
AI compliance means ensuring that the way your company develops, purchases, or uses AI follows the laws, contractual obligations, industry requirements, and internal policies that apply to it.
For example, a marketing team using AI to draft a generic blog post faces different privacy considerations from a healthcare provider using AI to summarize patient records. The second workflow may involve highly sensitive information, additional legal obligations, and stricter requirements for vendors and access controls.
Data protection
Determine what personal information enters the system, why it is needed, who receives it, and how long it is retained.
Security
Use suitable access controls, encryption, monitoring, and incident response measures to reduce exposure and unauthorized access.
Transparency
Provide appropriate information about data processing and explain AI involvement where required by law or business policy.
Accountability
Document decisions, assign responsibility, evaluate risks, and keep evidence that the organization follows its procedures.
2. GDPR and artificial intelligence
The General Data Protection Regulation (GDPR) is a European Union data protection law. It can apply to organizations established in the EU and, in certain circumstances, organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there.
Using AI does not automatically trigger every GDPR requirement. The important question is whether the business processes personal data within the regulation's scope and what role it plays in that processing.
Key GDPR principles for AI projects
- Lawfulness, fairness, and transparency: Identify a valid legal basis for processing and provide required privacy information.
- Purpose limitation: Use personal data for specified, legitimate purposes and assess whether further use is compatible with those purposes.
- Data minimization: Send an AI system only the personal information necessary for the task.
- Accuracy: Take reasonable steps to ensure personal data is accurate where accuracy matters to the processing.
- Storage limitation: Retain personal data only as long as necessary for the relevant purposes, subject to applicable legal requirements.
- Integrity and confidentiality: Apply appropriate technical and organizational safeguards.
- Accountability: Be able to demonstrate compliance rather than relying only on informal assurances.
These principles can affect the way a business selects training data, configures an AI assistant, uploads documents, stores prompts, and uses AI-generated recommendations.
Legal basis and consent
Companies should not assume that consent is always required—or that consent automatically makes every use of personal data lawful. GDPR provides several legal bases for processing, and the appropriate basis depends on the purpose and context. Organizations should identify and document the basis that applies to each relevant activity.
Data protection impact assessments
A Data Protection Impact Assessment (DPIA) may be required when a planned processing activity is likely to result in a high risk to individuals' rights and freedoms. AI systems involving extensive profiling, sensitive information, or consequential decisions deserve careful assessment.
Automated decisions and profiling
GDPR Article 22 addresses certain decisions based solely on automated processing that produce legal effects or similarly significant effects for individuals, subject to specified conditions and exceptions. Not every use of AI falls into this category. Businesses should examine how the decision is made, how much human involvement exists, and whether safeguards are required.
Practical example: An employer using AI to help organize job applications should assess the personal data involved, the transparency provided to candidates, the role of human reviewers, and whether the system makes decisions that trigger additional protections.
Read the European Commission's GDPR principles
3. HIPAA and AI in healthcare
The Health Insurance Portability and Accountability Act (HIPAA) is a US law that establishes requirements for protecting certain health information. Its Privacy, Security, and Breach Notification Rules are particularly relevant to covered entities and business associates that handle protected health information (PHI).
HIPAA does not automatically apply to every health-related business or every AI product. Whether it applies depends on the organization, the information, and the relationship between the parties.
Who must consider HIPAA?
- Covered entities: Certain health plans, healthcare clearinghouses, and healthcare providers that conduct specified electronic transactions.
- Business associates: Certain vendors and service providers that create, receive, maintain, or transmit PHI while performing services for a covered entity or another business associate.
- Relevant subcontractors: Organizations that handle PHI on behalf of a business associate may also have HIPAA obligations.
When does an AI provider need a BAA?
A Business Associate Agreement (BAA) establishes permitted uses and disclosures of PHI and requires appropriate safeguards when a provider qualifies as a business associate. If a cloud or AI service creates, receives, maintains, or transmits electronic protected health information on behalf of a covered entity or business associate, a HIPAA-compliant BAA is generally required, along with compliance with the other applicable HIPAA rules.
Encryption alone does not necessarily remove these obligations. HHS explains that a cloud provider may still qualify as a business associate even when it stores encrypted health information and does not possess the decryption key.
HIPAA safeguards to review
- Conduct and document a risk analysis for electronic protected health information.
- Use appropriate administrative, physical, and technical safeguards.
- Confirm whether the specific AI service and configuration can be used for the intended PHI workflow.
- Execute the required BAA before using a vendor for covered activities.
- Establish access restrictions, retention procedures, incident response, and breach notification processes.
- Verify that downstream vendors and integrations are covered by the necessary arrangements.
Read HHS guidance on HIPAA and cloud computing
4. GDPR vs. HIPAA: What is the difference?
| Topic | GDPR | HIPAA |
|---|---|---|
| Main focus | Protection of personal data within its scope. | Protection of PHI handled by covered entities and business associates. |
| Geographic reach | EU/EEA-related framework with certain extraterritorial applications. | US federal law, applicable to covered entities and business associates as defined by the law. |
| Information covered | Personal data relating to an identified or identifiable person. | Individually identifiable health information within HIPAA's scope. |
| Vendor requirements | Controller-processor arrangements and other contractual safeguards where required. | A BAA is generally required when a vendor qualifies as a business associate handling PHI for a covered entity or business associate. |
| Risk assessments | DPIAs are required for processing likely to result in high risk; other documentation duties may apply. | Covered entities and business associates must perform risk analysis and risk management for electronic PHI under applicable Security Rule requirements. |
| Individual rights | Includes rights such as access, rectification, erasure, restriction, portability, and objection, subject to applicable conditions. | Includes specific rights regarding access, amendments, and certain disclosures of PHI, subject to HIPAA's rules. |
A company may need to consider both frameworks—for example, a healthcare organization operating in Europe and serving US patients. The legal analysis must establish which laws apply to each processing activity rather than assuming one framework replaces the other.
5. Other AI and data privacy rules businesses should know
GDPR and HIPAA are not the only relevant requirements. Depending on where a business operates, what it does, and how its AI system is used, other rules may apply.
EU AI Act
The EU AI Act establishes obligations for certain AI systems and actors based on factors including risk category and role in the AI value chain. Some uses are prohibited, while high-risk systems can have additional requirements. Applicability and implementation dates depend on the provision and circumstances.
US state privacy laws
Depending on the state, business, and data involved, state privacy laws may regulate consumer data, rights requests, profiling, targeted advertising, and certain automated decision-making practices.
Check the relevant state laws and their current requirements.
Children's privacy
AI products processing children's personal information may trigger additional requirements. In the US, COPPA applies to certain online services collecting personal information from children under 13 and to other covered circumstances.
Contracts and industry rules
Customer contracts, financial-sector rules, confidentiality obligations, intellectual property restrictions, and internal security policies may impose requirements beyond general privacy law.
Companies should also review local laws in the countries where they operate. For example, organizations processing personal data in Peru may need to assess the Peruvian Personal Data Protection Law and its applicable regulations, rather than relying solely on GDPR or HIPAA.
6. How to make an AI system more privacy-compliant
Before deploying AI, build a repeatable process that covers the full lifecycle—from vendor selection and data entry to ongoing monitoring and deletion.
Step 1: Map the data
Identify what information the system receives, where it comes from, whether it contains personal or sensitive data, and which systems or vendors receive it. Include prompts, uploaded files, outputs, logs, and connected applications.
Step 2: Define the purpose and legal basis
Document why the business needs the AI workflow, what it will do, and whether the processing is lawful. For personal data covered by GDPR, identify the appropriate legal basis and provide the required privacy information.
Step 3: Evaluate the vendor
Review privacy terms, security documentation, retention settings, subprocessors, data location, incident notification terms, and data export or deletion options. Determine whether a data processing agreement, BAA, or another contract is required.
Step 4: Minimize the information shared
Remove unnecessary names, identifiers, account numbers, and confidential details. Use synthetic or anonymized data when it can achieve the same purpose. Pseudonymized data may still qualify as personal data under applicable law.
Step 5: Apply access controls
Use role-based permissions, multifactor authentication, least-privilege access, and managed accounts. Restrict integrations to the systems and records needed for the approved task.
Step 6: Assess high-risk uses
Consider a DPIA where required, and evaluate risks involving sensitive information, profiling, automated decisions, employment, healthcare, or access to essential services. Add appropriate human review and escalation procedures.
Step 7: Set retention and deletion rules
Specify how long prompts, outputs, source documents, and logs should be retained. Align deletion procedures with legal obligations, contractual terms, backup practices, and any required recordkeeping.
Step 8: Train employees
Give staff clear instructions about approved tools, prohibited data, verification of AI output, handling of external content, and incident reporting. Review the guidance regularly.
Step 9: Monitor and document
Keep records of approved use cases, assessments, vendor contracts, incidents, changes in configuration, and periodic reviews. Reassess the system when its purpose, data, or functionality changes.
7. Choosing an AI platform with compliance in mind
No AI provider can make every customer compliant simply by offering a secure product. The right choice depends on the workflow, legal requirements, contractual commitments, and configuration.
| Option | Potential advantages | What to verify |
|---|---|---|
| ChatGPT Business / Enterprise | Business-oriented workspace controls; OpenAI says business data is not used for model training by default. | Plan eligibility, retention settings, DPA, any required BAA, permitted data types, and specific configuration requirements. |
| Microsoft 365 Copilot | May fit organizations already using Microsoft identity, administrative controls, and document permissions. | Correct license and account, data access permissions, applicable terms, and whether the intended workflow meets requirements. |
| Claude commercial offerings | Business-oriented AI for writing, analysis, coding, and document workflows. | Commercial terms, data processing arrangements, retention, integration controls, and any industry-specific requirements. |
| Cloud AI platforms | Can provide deployment, identity, networking, and governance options that fit existing cloud architecture. | Exact model, region, logs, data processing terms, vendor chain, and the responsibilities shared by customer and provider. |
| Self-hosted models | May give an organization more control over where prompts and documents are processed. | Infrastructure security, model licensing, updates, logging, access controls, backups, and any outbound connections. |
For healthcare workflows, check the actual service and contract rather than relying on general marketing statements. OpenAI, for example, publishes guidance on eligibility and BAA arrangements for its API. Requirements differ by product and use case.
- OpenAI security and privacy
- OpenAI API: obtaining a BAA
- Microsoft Copilot enterprise data protection
8. AI compliance checklist for businesses
Use this interactive checklist as a starting point for reviewing an AI tool or use case. It is not a legal certification or a substitute for a formal assessment.
Check the controls that your organization has already implemented.
0 of 10 completed
Next step: Review the checklist with your privacy, legal, or security lead.
9. Common AI compliance mistakes to avoid
- Assuming encryption equals compliance: Encryption is important, but it does not replace legal bases, contracts, access controls, or other required safeguards.
- Assuming an enterprise plan solves everything: Business plans can provide stronger controls, but the customer must still configure and use them appropriately.
- Uploading real data unnecessarily: Use a generic example or remove identifiers if the task does not require actual personal information.
- Signing a contract after processing begins: Identify and complete required vendor arrangements before the relevant processing starts.
- Ignoring outputs: AI-generated results can contain personal data, errors, or sensitive inferences and should be handled appropriately.
- Automating important decisions without review: Employment, credit, healthcare, and other consequential decisions can involve additional legal and ethical requirements.
- Failing to reassess: A tool may change its features, vendors, terms, or data flows. Revisit the assessment when material changes occur.
Frequently asked questions
Does GDPR apply to every business using AI?
No. GDPR applies when its territorial and material scope requirements are met. A business outside the EU may still fall within its scope in certain circumstances, including offering goods or services to people in the EU or monitoring their behavior there.
Is HIPAA compliance required for every AI healthcare app?
No. HIPAA applies to covered entities and business associates as defined by the law. Other privacy laws may apply to health-related apps even when HIPAA does not. Evaluate the organization, data, and service relationship.
Can a business use ChatGPT and comply with GDPR?
Potentially, depending on the processing, the organization's role, the applicable legal basis, the service configuration, contractual arrangements, transparency, retention, and other safeguards. Using a particular product does not itself establish compliance.
Can ChatGPT process protected health information under HIPAA?
Only if the specific service and configuration are eligible for the intended workflow and the necessary contractual and operational requirements are met. Confirm whether a BAA is available and required, and review the provider's current documentation before processing PHI.
What is a data processing agreement?
A data processing agreement (DPA) sets out relevant terms between parties when one processes personal data on behalf of another. Under GDPR, controller-processor arrangements must include the required contractual provisions when Article 28 applies.
What is the difference between a DPA and a BAA?
A DPA commonly addresses personal data processing responsibilities under laws such as GDPR. A BAA is a HIPAA-specific agreement for covered relationships involving protected health information. They serve different legal frameworks and are not interchangeable.
Does using anonymized data eliminate all privacy obligations?
Not necessarily. Data that is genuinely anonymous may fall outside personal-data rules such as GDPR, but pseudonymized data generally remains personal data. Re-identification risk, other legal duties, confidentiality, and contract terms should also be considered.
Can a small business handle AI compliance without a dedicated legal team?
Smaller businesses can begin with an inventory of AI tools, data classification, vendor review, access controls, staff guidance, and documented procedures. However, high-risk or regulated processing may require specialist legal, privacy, or security advice.
Conclusion: Build compliance into your AI strategy
AI compliance is not a one-time checkbox. It is an ongoing process of understanding your data, choosing appropriate tools, assessing risk, establishing contracts, protecting access, and reviewing how systems are used.
GDPR focuses broadly on personal data within its scope, while HIPAA establishes specific protections for health information handled by covered entities and business associates. Other laws, including the EU AI Act and applicable national or state privacy laws, may introduce additional requirements.
The most practical starting point is to identify one AI use case, map its data flows, confirm which rules apply, and document the safeguards before expanding it across the organization. If the use case involves sensitive personal data, healthcare records, profiling, or consequential decisions, obtain appropriate professional advice before deployment.