GDPR and Artificial Intelligence: How to Use AI in Your Business in Compliance with the Law

Practical guide on implementing AI solutions in Portuguese businesses while respecting GDPR. Legal obligations, best practices and how to protect your customers' data.

AI and data protection: a necessary balance

The adoption of artificial intelligence in Portuguese businesses brings enormous opportunities, but also important responsibilities regarding personal data protection. The General Data Protection Regulation (GDPR) does not prohibit the use of AI, but it requires that it be done transparently, securely and respecting citizens' rights.

For SMEs, understanding this intersection between AI and GDPR is not just a legal matter, it's a competitive advantage. Customers and business partners trust companies that demonstrate respect for their data more.

What GDPR requires when using AI

The GDPR establishes fundamental principles that apply directly to AI use:

Transparency

Customers must know they are interacting with an AI system. If a chatbot or voice agent serves your customer, they must be informed that they are speaking with an artificial assistant.

Purpose

Data collected by AI can only be used for the stated purposes. If you collect phone call data to improve service, you cannot use it for marketing without additional consent.

Data minimisation

Collect only strictly necessary data. If the voice agent only needs the name and reason for the call, it should not ask for the address, tax number or other personal data.

Accuracy

Data processed by AI must be kept up-to-date and correct. Data errors can lead to incorrect automated decisions.

Storage limitation

Data should not be kept indefinitely. Set clear retention periods and delete data when no longer necessary.

Automated decisions and the right to explanation

One of the most relevant aspects of GDPR for AI is Article 22, which deals with automated decisions. If your AI makes decisions that significantly affect customers (for example, approving or rejecting a credit application, classifying a customer's priority, or deciding a service price), individuals have the right to:

• Be informed that the decision was made by an automated system
• Know the underlying logic of the decision-making process
• Contest the decision and request human intervention

In practice, this means:

• Your AI tools must be able to explain how they reached a decision
• There must always be a mechanism for a human to review automated decisions
• AI process documentation must be up-to-date and accessible

For most SMEs using AI for customer service, scheduling or lead qualification, these obligations are relatively straightforward to meet.

Best practices for using AI in compliance

1. Conduct a Data Protection Impact Assessment (DPIA)

Before implementing any AI system that processes personal data, carry out a DPIA. Identify risks and define measures to mitigate them.

2. Update your Privacy Policy

Include clear information about AI use: which systems you use, what data they process, for what purposes and for how long.

3. Obtain consent when necessary

For AI uses that go beyond contract performance or legitimate interest, obtain explicit and informed consent.

4. Choose compliant suppliers

When using third-party AI tools, verify they comply with GDPR. Enter into sub-processing agreements that clearly define each party's responsibilities.

5. Train your team

Employees working with AI must know data protection obligations and what they must not share with external tools (see Shadow AI: the Invisible Risk of the AI Tools Your Team Already Uses). Regular training is essential to prevent incidents and meets the AI literacy duty in the AI Act (Article 4), which the Digital Omnibus recalibrated into a duty to take supporting measures rather than to guarantee an individual level of competence, according to analyses such as KI-Campus.

6. Implement technical security measures

Data encryption, access controls, activity logs and regular backups are mandatory when processing personal data with AI.

The European AI Regulation (AI Act)

Beyond GDPR, businesses should be aware of the European Artificial Intelligence Regulation (AI Act), in force since 1 August 2024 and applied in phases. Prohibited practices have applied since February 2025 and the rules for general-purpose AI models since August 2025. For high-risk systems, the Digital Omnibus approved in 2026 postponed the obligations to 2 December 2027 (standalone systems) and 2 August 2028 (systems embedded in regulated products), and the labelling of AI-generated content moved to 2 December 2026.

This regulation classifies AI systems by risk level:

• Unacceptable risk: Prohibited systems (such as social scoring or subliminal manipulation)
• High risk: Systems subject to rigorous requirements (AI in recruitment, credit, healthcare)
• Limited risk: Systems with transparency obligations (such as chatbots that must identify themselves as AI)
• Minimal risk: Systems without specific obligations (most AI applications in SMEs)

For most Portuguese SMEs, typical AI applications, chatbots, voice agents, process automation, fall into the limited or minimal risk categories. This means obligations are generally around transparency: informing users they are interacting with AI.

Practical checklist for SMEs

Use this checklist to verify compliance of your AI projects:

• Are customers informed when they interact with AI?
• Does the privacy policy mention the use of AI systems?
• Is data collected by AI minimised to what's necessary?
• Is there a defined retention period for data?
• Do AI suppliers have GDPR sub-processing agreements?
• Has the team received training on data protection and AI?
• Is there a process for customers to exercise their rights (access, rectification, deletion)?
• Has an impact assessment been conducted for higher-risk AI systems?

If you answered yes to all, your company is well positioned. If you identified gaps, now is the time to address them.

Frequently asked questions

Can I use AI in customer service without breaching GDPR?

Yes, provided there is transparency (telling the customer they are talking to AI), a defined purpose, data minimisation and retention periods. For higher-impact systems, carry out a Data Protection Impact Assessment (DPIA).

What does GDPR Article 22 say about automated decisions?

If AI makes decisions that significantly affect people, they have the right to be informed, to know the logic behind the decision and to contest it, with human intervention.

Does the AI Act apply to my SME?

It applies to anyone using AI in a professional context. For chatbots and voice agents, the obligations are mainly about transparency. The timetable for high-risk systems was postponed to 2 December 2027 (standalone systems) and 2 August 2028 (systems embedded in regulated products).

Read also: AI Agents in Customer Service, IEFP Digital Training Voucher and AI Agents: Why Most Pilots Never Reach Production.

At TecLab, all AI solutions we implement are designed with GDPR compliance as a priority. We help Portuguese SMEs harness the power of artificial intelligence without compromising their customers' privacy.