Frequently asked questions about security, privacy and GDPR
24 questions
GDPR-compliant AI → Can AI be used with personal data?
Yes, but the architecture has to take into account purpose, access, providers, storage and protective measures.
Can AI be used with sensitive data?
It may be possible, but it requires a stricter assessment of architecture, risks and providers.
Where is the data processed?
The application, the database and the logs run in a cloud account in the client’s name. The only thing that leaves it is the call to the model provider, with the provider, contract and configuration the client approves. If the assistant lives on WhatsApp or Telegram, that channel also receives the conversation.
Can private infrastructure be used?
Yes. Some projects can deploy components in controlled or private environments.
Can a private model be used?
Yes, when security, cost or control requirements justify it.
How are permissions controlled?
Through identity, roles, authorized sources, allowed tools and access rules.
Can the system’s actions be logged?
Yes. Traceability can include the tools used, decisions, states and results.
Can there be human approval before an action?
Yes. Human sign-off can be required for sensitive operations.
How do you minimize the information sent to a model?
By selecting only the necessary context and leaving out data that isn’t relevant to the task.
Can an AI system comply with GDPR?
It can be designed to operate within the applicable requirements, but compliance depends on the case, the data, the providers and the processes.
Does Ideasforge advise on GDPR?
No. Saying whether a company complies with the law is the job of its lawyers, not ours.
What we do is build the system so compliance can be demonstrated, process the data on your behalf under a data processing agreement and give your data protection officer and your lawyers the material they need to assess it.
Artificial intelligence, privacy and GDPR → Is security added at the end?
No. Permissions, traceability, providers and limits should be defined from the design stage.
Can information be anonymized before it’s sent to the model?
Yes. Anonymization or techniques that separate the data from the person can be applied when appropriate.
Can you limit how long information is kept?
Yes. The retention policy can be part of the system’s design.
Can the information be encrypted?
Yes. Encryption in transit and at rest can be used depending on the architecture.
Can you control which users see each conversation?
Yes. Access can be limited by identity and permissions.
Can you audit who carried out an action?
Yes. The system can log the user, tool, action and result.
Can a solution be hosted in the client’s cloud?
Yes. The infrastructure is always set up in a cloud account in the client’s name, never in ours.
Can it be deployed on-premise?
Some components can be deployed on your own infrastructure if the project requires it.
Can you prevent the data from being used to train external models?
With the providers and configuration we deploy, yes. Calls to the model run under agreements and settings that exclude training on your content, and you approve the choice of provider.
Artificial intelligence, privacy and GDPR → What happens if a user tries to access restricted information?
The system should block retrieval and log the attempt when necessary.
Can a company set different policies by data type?
Yes. Different rules can apply to public, internal, confidential or sensitive data.
Can a system meet internal security requirements in addition to GDPR?
Yes. The architecture can be adapted to company policies, as long as they’re technically feasible.
Is security testing recommended?
Yes, especially when the system accesses sensitive data or carries out actions on critical systems.
Tell us about the process you want to improve.
You do not need to know which model to use, which architecture you need or whether the problem calls for an AI agent. Tell us how the process works today, who is involved and which tools you use.
We’ll reply within one business day with a first read of your case.