PIPELINEGuide
Process Automation and Data Protection: What the GDPR Requires
As soon as personal data is processed in process automation, clear obligations apply. What these are specifically, what's almost always missing in practice, and what actually suffices.
As soon as personal data is processed in process automation, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every involved service provider. In practice, the same three things are almost always missing: the deletion period, the notice at the collection point, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
Practically, this means for process automation: a data processing agreement with every involved service provider, checking where processing takes place, a documented deletion period, and an understandable passage in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
What if our processes change?
Then the workflows are adjusted. We build them so that the variable parts — text blocks, recipients, thresholds — are in a table that you maintain yourself, without needing us.
How quickly does it pay off?
For the processes we typically start with, payback is between four and ten months. We calculate that before the quote, not after.
Do we lose control over our processes?
On the contrary: An automated process is fully documented and logged for the first time. You see every run. Before, only the person who always did it knew.
Are there subsidies for this?
For digitalization projects in Austria, there are several funding programs, such as KMU.DIGITAL or the aws digitalization funding (kmudigital.at, aws.at). Whether and to what extent this currently fits your situation, we check together — important: The application must be approved before the contract is awarded. Plan lead time for this.
Do we have to buy new software for this?
Usually not. Most of it runs on the systems you already have, plus an automation layer. We only suggest new software if there's a real gap.
What happens to the people who used to do this?
In practice, a position rarely disappears — the part of the work that nobody liked disappears. The time goes into things there was never time for before.
How do we know what's worth automating?
Rule of thumb: A process is worth it if it occurs at least weekly, has clear rules and is manual work today. In the current-state analysis, we calculate every candidate — frequency times duration times cost — and you decide based on numbers.
05 — Next
Related pages
- Process automation — Overview
- Process automation — Duration
- Process automation — requirements
- Process Automation — Common Mistakes
- Process automation — alternatives
- Process Automation — Practical Examples
- Process Automation — Funding
- Process automation — process
- AI automation
- CRM integration
- Automate Quote Creation
- All guides
Process automation by region
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.