Copilot, ChatGPT, an HR assistant, or an agent: almost all AI applications process personal data, and the GDPR already applies, without any grace period or timeframe. In 12 questions, this free check gives you a red, orange, or green verdict, the gaps to address, and a 90-day action plan.
Get your verdict: red, orange, or green?
Twelve questions about your register, your suppliers, your impact assessments, and the information provided to individuals. The verdict is displayed immediately, without registration. The detailed PDF report is then sent to you by email if you wish.
Your results by pillar
Discrepancies to be addressed as a priority
Your 90-day action plan
Receive the full report in PDF format
All identified discrepancies, the action to be taken for each, the 90-day plan, and a reminder of the framework, to be shared with your DPO and management. You will also receive the sponsor's GDPR kit (Word + Excel).
The report will be sent to you by email. We promise not to send you unsolicited emails. Privacy Policy
What the GDPR requires for your use of AI
Unlike the AI Act, the GDPR is not being implemented in stages: it already applies to any use of AI that processes personal data, which is to say, almost all such uses. It requires registering these processing activities (Article 30), regulating providers through contracts (Article 28), analyzing the impact of high-risk processing (Article 35), informing individuals (Articles 13 and 14), guaranteeing human intervention in automated decision-making (Article 22), and securing data (Article 32). The CNIL (French Data Protection Authority) clarified its approach to AI in 2024 and 2025 and prioritized recruitment for its 2026 audits. The digital omnibus approach has not been adopted: the GDPR applies as is.
In practice, a large organization must be able to demonstrate that it understands which uses process which data, that it has regulated its suppliers, assessed risks, and informed its employees. This is what the check measures, based on four pillars.
Register and qualification
The uses of AI recorded in the register, each project qualified with the DPO before its launch, the categories of data known.
suppliers
An Article 28 contract that excludes the reuse of your data for training, documented transfers outside the EU, verified parameters.
Impact analysis and security
An impact analysis for risky uses, a review of access rights before opening an assistant, real human intervention.
People and rules
Providing information to employees, clients and candidates, a charter that says what is never understood, a procedure for rights requests.
How is the verdict calculated?
Each answer is worth 0 to 3 points. The score for each pillar ranges from 8 to 100, and the overall score is the average, as in our other... AI diagnosticsThe verdict does not depend solely on the score: four key points carry more weight, because an audit will begin with them.
And after the check?
Le GDPR Kit for AI Project Sponsors It transforms your discrepancies into a comprehensive report: the five questions the DPO will ask you, the six project categories, the supplier questionnaire, the express impact analysis, and the information notice templates, in Word and Excel. AI charter template sets the rules of use. Two other checks complete this one: the check article 4 of the AI Act on mastering AI and the AI check and social dialogue regarding the consultation of the CSE.
Our training courses incorporate the specific rules of each tool actually deployed: what can be entered, what should never be entered, and how to maintain control over what the AI produces. Details are available on the page. training organization.
F.A.Q
Does the GDPR apply to a simple assistant like Copilot or ChatGPT?
Yes, as soon as personal data passes through the tool—a name in an email, meeting minutes, a customer exchange pasted into a prompt—is sufficient. Your organization remains responsible for the processing; the provider is a data processor for the service.
Isn't the supplier responsible for compliance?
Not for you. It's your responsibility to review the subcontracting agreement, disable any reuse of your data for training, document location and transfers, and establish usage rules. A business offering facilitates compliance, but it doesn't replace it.
Is an impact assessment mandatory?
Not for all uses. It is required when the processing presents a high risk: sensitive data, employee evaluation or monitoring, decisions concerning individuals, large-scale processing. In other cases, it must be possible to demonstrate why it was not required.
What does the PDF report contain?
The verdict and score, the results by pillar, all identified gaps with the action to be taken for each, a 90-day action plan, and a reminder of the framework. You also receive the sponsor's GDPR Kit, in Word and Excel formats. See a sample report (PDF, dummy answers).
Are my answers saved?
The verdict is displayed without registration, and your answers remain in your browser. If you request the report, your address and answers are used to send it to you and to discuss it with you; they are neither sold nor used for a newsletter.
An AI project that needs to be aligned with your DPO (Data Protection Officer)We help you qualify your projects, prepare the documentation your DPO expects, and train your teams on best practices. Response within 24 business hours.
Request a proposal