Generative AI shakes up GDPR and privacy
The emergence of generative artificial intelligence in the daily lives of businesses is no longer a matter of anticipation, but a palpable reality that is profoundly disrupting data management, confidentiality, and compliance with ethical obligations, particularly in regulated professions. While the promise of generative AI lies in its ability to automate, accelerate, and optimize processes, it also opens a Pandora's box of questions related to data protection and regulatory compliance. Behind the technological appeal, a field of new responsibilities is emerging, where law, ethics, and cybersecurity must advance hand in hand with innovation.
In this context, the European Union was a pioneer in establishing, with the GDPR, a foundation of demanding principles: lawfulness, transparency, minimization, accuracy, limitation of retention, and data security. These foundations have disrupted data collection and processing practices, requiring each player to adopt a proactive stance of "privacy by design" and "privacy by default." The arrival of generative AI, which feeds on and improves through contact with massive volumes of personal and sometimes sensitive data, only intensifies these requirements. Every AI project must now be designed with an upstream consideration of privacy risks and traceability of processing.
The rise of generative AI cannot be conceived without clear governance. Companies are therefore required to clarify, project by project, the role of each stakeholder: who is the data controller? Who acts as a processor? Who are the potential co-controllers? This distinction has direct implications for the distribution of obligations, the drafting of contracts, and the risk of sanctions in the event of non-compliance. The implementation of robust contracts, incorporating AI-specific clauses—such as human supervision, bias correction, technical documentation, and end-of-contract management—is becoming an essential requirement to secure exchanges and ensure stakeholder trust.
In this new ecosystem, the Data Protection Officer (DPO) has become a central figure. Their role is no longer limited to simple ex-post control but extends to strategic advice: they raise awareness, provide training, lead impact assessments (DPIAs), and ensure alignment between the GDPR, the AI Act, and, where applicable, specific obligations arising from European cybersecurity directives (NIS/NIS2). Alongside the DPO, the emergence of AI experts, acting as bridges between technical and legal teams, contributes to more cross-functional governance and better risk management.
Compliance doesn't stop at the company's boundaries. It permeates the entire value chain, from solution providers to end users, including subcontractors and technology partners. In this regard, regulations are evolving: with the European AI Act, the European Union is setting a new benchmark by proposing a risk-based approach. AI systems are thus classified into four categories: unacceptable risk (prohibited), high risk (stricter regulation), limited risk (transparency obligations), and minimal risk (unrestricted use). Suppliers and deployers of high-risk systems face increased requirements regarding documentation, risk management, human oversight, data quality, and major incident notification.
The cross-cutting nature of the regulations – GDPR, AI Act, NIS2 – necessitates constant vigilance and proactive monitoring, both technical and regulatory. For many organizations, this translates into the creation of robust internal policies: AI committees, usage charters, audit and code review processes, regular training, and incident management procedures. Each new project undergoes cross-validation by the DPO, CISO, and business stakeholders, thus ensuring a comprehensive and shared understanding of the risks.
The integration of generative AI into regulated professions, such as accountants, raises specific challenges. These professionals are subject to a dual requirement: respect for professional secrecy and the guarantee of absolute discretion in the processing of their clients' data. This obligation, a matter of public policy, takes precedence over all private interests and is subject to criminal sanctions in the event of a breach. The introduction of generative AI tools into these environments therefore requires increased attention: each use, each sharing of data must be anticipated, documented, and contractualized, so as not to expose the confidentiality of information to risks of disclosure or uncontrolled use.
Zero risk does not exist in the digital world, as supervisory authorities remind us. The challenge is not so much to completely eliminate risk, but to reduce it to an acceptable level through a combination of appropriate technical and organizational measures. Anonymization and pseudonymization, for example, are practices to be encouraged to limit the re-identification of individuals, although their implementation must be rigorous and continuous. Similarly, user awareness and training appear to be major levers: the best cybersecurity policy or the most sophisticated contract cannot compensate for human error or a lack of data culture on a daily basis.
The risks associated with generative AI are numerous. They affect the transparency of processing—AI often remains a "black box" that is difficult to audit—the quality and accuracy of the results produced, algorithmic biases that can lead to discrimination, and cybersecurity: data poisoning attacks, exfiltration via malicious prompts, and data leaks in the event of system misconfiguration or the use of uncontrolled cloud solutions. The consequences are potentially serious: administrative, criminal, and disciplinary sanctions, damage to reputation, and loss of customer and partner trust.
Faced with this panorama, a technical approach alone is not enough. The effectiveness of cybersecurity measures depends on the robustness of the legal framework, and vice versa. It is through the synergy between engineers, lawyers, DPOs, and senior management that collective resilience is built. Training, auditing, and certification (via recognized standards such as ISO 27001 or 27701, or national cybersecurity labels) help professionalize data governance and provide guarantees to all stakeholders.
The regulatory landscape is not static: the implementation timeline for the AI Act spans several years, with key milestones as early as 2025 for prohibiting systems with unacceptable risks, training employees, and ensuring the compliance of general-purpose models. Organizations are encouraged to map their AI usage now, anticipate documentation, compliance assessment, and human oversight requirements, and adapt their contractual practices and internal policies.
At the heart of this transformation, humans must remain the center of gravity of decision-making. Ethics must not be relegated to the status of a formality: it permeates every technological choice, every use, every customer relationship. The trust of users, whether customers, partners, or employees, constitutes the essential foundation for the sustainable adoption of generative AI. This trust is built on transparency, education, and the commitment of all stakeholders to respect fundamental rights and guarantee data security throughout the project lifecycle.
Generative AI thus represents a tremendous opportunity for companies wishing to strengthen their competitiveness, innovate, and create value. But this opportunity can only be realized through constant vigilance, ongoing dialogue between business lines, legal professionals, and technical experts, and resolute investment in governance, training, and compliance. Only then will the generative AI revolution deliver on its promises, without ever sacrificing what matters most: trust, confidentiality, and respect for people.
To go further: these GDPR issues extend our analysis of Shadow AI et our article on the AI charter in business.