PIPELINEGuide
Data privacy and AI compliance: contract, ownership, and exit
Who owns the data, access credentials, and outputs in the end? The answer to this question says more about a provider than any reference list — and belongs before the signature, not after.
Before commissioning data privacy and AI compliance, clarify in writing: data and access belong to the client, in what format and timeframe they will be handed over upon termination, what future changes will cost, and that documentation is a quoted line item, not a verbal promise.
01 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
02 — Questions
Questions you should ask
- What happens if the project becomes more expensive than estimated — who bears that?
- Who owns data, access, and, if developed, the source code?
- What does operation cost in the second and third year?
- What does the documentation we receive at the end look like?
- How would you measure whether the project was successful?
- Is there a case in which you would advise us against this?
03 — Warning signs
When to be skeptical
- Guaranteed results. Anyone promising top Google ranking or a specific revenue increase is selling something they can't deliver.
- No pushback. A provider who thinks every project is a good idea has either not listened or is only selling.
- Time pressure. Limited-time discounts on project prices are a sales tool, not an offer.
- Unclear ownership. Anyone who won't clearly say who owns data and access doesn't have your interests at heart.
- No contact with technical expertise. If only sales sits in the first meeting, that's where misunderstandings arise.
04 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — integration
- Data protection and AI compliance — AI labeling
- Data protection and AI compliance — measuring success
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — implementation
- Data protection and AI compliance — Funding
- Data protection and AI compliance — provider comparison
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.