Why AI Use Matters Under GDPR
Personal data sent to an AI service is processing by that vendor, which needs a lawful basis, processor terms and, often, a transfer mechanism. Uncontrolled AI use means personal data goes where the records of processing say it does not.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| Art. 32 Security of processing | Personal data findings stopped or redacted. |
| Art. 30 Records of processing (data inventory) | Personal data located on endpoints and inventoried by category. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting GDPR for a client applies these packs in one step:
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Set retention in Client Settings to match the client’s records policy
- Enable data-at-rest discovery for Art. 30 inventory evidence
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
AI Apps to Decide On First
- ChatGPTMedium
- ClaudeMedium
- Google GeminiMedium
- Microsoft CopilotLow
- Meta AIMedium
- GrammarlyMedium
- Copy.aiMedium
- WritesonicMedium
- QuillBotMedium
- Hugging Face (Chat & Spaces)Medium
- LMArenaHigh
- GrokMedium
Questions
Is pasting customer data into ChatGPT a GDPR issue?
It can be. The data is then processed by a vendor the controller may have no processor agreement with. ProctoredAI redacts government ID numbers and warns on bulk contact details before they are sent.
Where does ProctoredAI process data?
Inspection happens on the device, and by default events carry redacted findings rather than the content. The Data Processing Addendum and the Security page give the details.
How does it help with records of processing?
Data-at-rest discovery locates personal data on endpoints by category, as evidence for an Article 30 inventory, and retention follows the client's records policy.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide