In 30 seconds
- Pasting customer data into an AI counts as processing personal data: the GDPR (RGPD) applies and your shop remains responsible.
- From 2 August 2026, if an assistant chats with customers, they must know they’re talking to an AI.
- Use business plans with a data processing agreement, not personal accounts.
- Anonymise before pasting and always review what the AI publishes.
ChatGPT, Claude or Copilot are already everyday tools in many shops: product descriptions, emails, sales analysis. The risk comes when someone pastes a customer list, a contract or an employee’s details without thinking about where they end up. This guide helps you get it in order without overcomplicating things.
The two rules that matter
GDPR (RGPD)
It applies whenever you process data about identifiable people: name, phone number, email, address, purchase history. Pasting it into an AI counts as processing, and your shop remains responsible.
EU AI Act
Regulation (EU) 2024/1689, known as the AI Act, applies in phases. For a shop using general-purpose AI, the most relevant part is the transparency set out in Article 50.
What the GDPR asks for in practice
Legal basis
To use that data for that purpose. A customer giving you their email for the receipt doesn’t allow you to use it for anything else.
Data minimisation
Use only the data you need. If the AI doesn’t need the name, leave it out.
Processor agreement
With the AI provider if you pass personal data to it. It’s what business plans offer.
Inform
State in your privacy policy whether you use third-party tools to process customer data.
Italy fines OpenAI 15 million euros
The Italian data protection authority fined OpenAI for using personal data to train ChatGPT without an adequate legal basis, for a lack of transparency towards users, for not reporting a data breach from March 2023 and for not verifying age. It also required it to run a six-month information campaign.
The takeaway: the AI providers themselves are under scrutiny. Choose plans with a data processing agreement and the option for your conversations not to be used for training.
Source: LaPresse, 20 December 2024 ↗
What the AI Act asks for
- If you put in place an assistant that chats with customers, people must know they’re talking to an AI, unless it’s obvious.
- Be careful with AI-generated or manipulated content that could look real, such as images or videos of people.
- Your staff must have a sufficient level of AI literacy (Art. 4, mandatory since February 2025).
Personal or business plan
A free account someone opened with their personal email is not the same as a business plan taken out by the shop. Broadly speaking:
| Aspect | Personal plans (free or individual paid) | Business plans (Team, Business, Enterprise, API) |
|---|---|---|
| Use of your conversations to train models | May be switched on depending on the provider and settings; check your settings | Not used for training by default |
| Data processing agreement | Usually none | Available, with terms adapted to the GDPR (RGPD) |
| User management | Each person manages their own account | The company adds and removes users |
| Who owns the account | The employee | The company |
What you can paste and what you can’t
Samsung engineers paste internal code into ChatGPT
Several engineers uploaded the company’s source code to ChatGPT. Samsung banned generative AI tools on its devices and internal networks, asked staff not to share company information from personal devices and warned of penalties up to and including dismissal.
The takeaway: whatever you paste into an AI leaves your company. It’s worth having an internal policy before the team starts using it on their own.
Source: Bloomberg Línea, 2 May 2023 ↗
| Type of information | Personal plan | Business plan with a contract |
|---|---|---|
| Product descriptions, marketing copy, ideas | Yes | Yes |
| Aggregated sales with no personal data (by shop, by category) | Yes, if it isn’t confidential business information | Yes |
| Public reviews, without the author’s name | Yes | Yes |
| Customer emails with a name, phone number or address | No. Anonymise first | Only if necessary and with a legal basis |
| Customer lists or databases | No | Only with a clear purpose and the minimum data |
| Employee data: payslips, appraisals, sick leave | No | With great caution; health data, best never |
| ID numbers (DNI), bank or card details | No | No |
| Passwords and logins | No | No |
How to anonymise
Most of the time the AI doesn’t need to know who the customer is. Just remove or replace whatever identifies them:
Identifying details are names, emails, phone numbers, addresses, order or membership numbers, and any detail that could let someone be recognised.
Example A made-up email, before and after anonymising it:
The customer’s email
“Hello, I’m Laura Gómez, member number 48213. I bought a coat at your shop on Calle Mayor on the 3rd and the zip has broken. My phone number is 600 000 000. I’m very disappointed.”
What you paste into the AI
“Hello, I’m [CUSTOMER]. I bought a coat at your [SHOP] shop a few days ago and the zip has broken. I’m very disappointed.”
Internal policy template
One page of rules saves the team a lot of doubts. You can copy this one and adapt it, or download it in Word ready to sign:
DOCXTemplate: AI use policy (in Spanish)Editable Word file with the 7 points and a signature table for the team.Download ↓AI use policy for [SHOP NAME]
1. Approved tools. Only the tools the company has subscribed to are used: [for example, ChatGPT Business, Claude Team or Microsoft 365 Copilot]. Personal accounts are not used for work matters.
2. Permitted uses. Product and marketing copy, email drafts, summaries, ideas, analysis of aggregated data and support with internal tasks.
3. Prohibited data. ID numbers (DNI), bank or card details, passwords, health data and employee data are never entered. Customer data is anonymised whenever possible.
4. Human review. Everything that goes out to a customer or is published (replies to reviews, emails, website copy) is checked by a person first.
5. Transparency. If a customer is talking to an AI assistant, they are told clearly at the start.
6. Questions and incidents. If someone enters data by mistake that they shouldn’t have, they tell [PERSON RESPONSIBLE] that same day. Reporting it is never a problem; hiding it is.
7. Person responsible. [NAME] reviews this policy every six months and grants and removes access.
Date: [DATE]. Read and accepted by: [NAME AND SIGNATURE].
Before you launch a chatbot
Air Canada has to answer for what its chatbot said
The assistant on its website told a customer he could claim the bereavement fare after flying. The actual policy said the opposite. The airline argued that the chatbot was responsible for its own actions, but the tribunal rejected this and ordered it to compensate the customer.
The takeaway: whatever your chatbot says, your shop is saying. Limit it to information you have checked.
An assistant on your website or on WhatsApp that answers questions about opening hours, delivery or returns can be very useful. Before switching it on, tick off each point:
- The first message says clearly that it’s an AI assistant. For example: “Hi, I’m the virtual assistant for [SHOP], an artificial intelligence. If you’d rather talk to a person, type PERSON”.
- There’s a simple way to reach a person, and someone deals with those cases.
- It only answers with information you have given it: opening hours, delivery and returns policies, FAQs.
- You’ve tested difficult questions: complaints, discount requests, off-topic questions, attempts to make it say something inappropriate.
- It doesn’t ask for data it doesn’t need. If it needs an order number, it doesn’t ask for an ID number.
- You have a data processing agreement with the tool’s provider.
- Your privacy policy mentions the assistant and the provider.
- You know how long conversations are kept and where.
- Someone reviews a sample of conversations every week during the first month.
- There’s a plan to switch it off quickly if it starts giving bad answers.
Check what the AI publishes
AI proposes; you decide.
Where to start
Five steps for this week:
- Ask the team which AI tools they use and with which accounts. Without judging: the aim is to know.
- Decide which business tool you’re going to use and sign up for the right plan.
- Adapt the policy template, explain it in a short meeting and ask everyone to sign it.
- Show with a real example how to anonymise an email.
- If you’re going to launch a chatbot, go through the checklist above before switching it on.
This article is for guidance only and is not a substitute for legal advice. Providers’ terms and the way regulations are applied may change. If you handle sensitive data or have specific questions, consult your data protection officer or a specialist lawyer.