PIPELINEGuide
AI consulting and data protection: what GDPR requires
As soon as personal data is processed in AI consulting, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
As soon as AI-powered advisory services process personal data, you need a legal basis, purpose limitation, defined retention periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the retention period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for AI consulting: a data processing agreement with every service provider involved, verification of where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
How does this differ from consulting by the Chamber of Commerce?
The Chamber offerings provide a good overview of funding options and basics. We go a step further and look at your specific processes and systems — with effort estimates that we ourselves would have to meet.
Isn't a conversation with management enough?
No, that's the most common reason for a list that doesn't work later. The people who do the processes daily know the exceptions that an outside perspective never sees.
Isn't this just a disguised sales event?
The recommendation regularly includes items you can implement yourselves or with your existing service provider, as well as cases we advise against. The document is yours and works without us too.
What if nothing makes sense for us?
Then that's what the report says. It happens, especially with businesses that have very few recurring processes or no digital data foundation. An honest no is cheaper than a project that runs aground.
What funding is available in Austria?
Options include KMU.DIGITAL and aws digitalization funding — current terms at kmudigital.at and aws.at. Both require the application to be approved before awarding the contract — that's why we bring it up early and not at the end.
Who should be at the workshop?
At least one person from management and two to three who do the affected processes daily. Without the second group, you get a list that doesn't work in practice.
Do we also get recommendations for providers other than you?
Yes, where it makes sense. Some use cases are better suited to standard software or a specialized provider — that's stated in the document, not hidden.
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.