PIPELINEGuide
Data privacy and AI compliance: where to start without losing focus
The most common mistake when starting is not the wrong technology, but the wrong first step. A sequence that has proven itself in small businesses.
Getting started with data privacy and AI compliance doesn't begin with technology, but with a week of documenting: what repeats, what costs the most time. Then a single, clearly defined process with a measurable goal — only with clear scope do quotes become comparable at all.
01 — Getting started
Where to begin
Name the bottleneck
Not the most interesting thing, but what takes the most time. A week of tracking what repeats delivers a more realistic list than any workshop.
Define a small scope
One process, one measurable goal. What works gets expanded — what doesn't costs little.
Survey the starting situation
What content, data, and access is available. For data protection and AI compliance, this is the factor that most strongly influences effort and timeline.
Decide who is responsible
For the implementation and for operations afterward. Without this definition, every system becomes outdated.
Only then request proposals
With a clear scope, proposals become comparable. Without it, you get numbers that have nothing to do with each other.
02 — Fit
When it's worth it
- The process in question occurs at least weekly.
- It follows rules you can write down — even if there are exceptions.
- Today it's manual work that no one enjoys doing.
- There's one person who decides, not three who need to coordinate.
- You can name what would tell you it worked.
03 — Checklist
Clarify before the first quote
- What should improve? In one sentence, no jargon.
- How will you know? One number that should change.
- Who decides? One person, not a committee.
- What budget is available? A range is enough — it makes quotes comparable instead of arbitrary.
- By when? And what the deadline depends on.
- Which systems are involved? And who has access to them.
- What do you already have? Content, data, preliminary work — this reduces the cost.
04 — Questions
Frequently asked questions
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — duration
- Data protection and AI compliance — contract and ownership
- Data protection and AI compliance — data protection
- Data protection and AI compliance — Ongoing operations
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — practical examples
- Data protection and AI compliance — AI labeling
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.