Where the data goes: AI systems explained for the data protection officer

A defensible answer to whether an AI system may process the data it needs: a legal basis, a documented data flow, processing agreements with every provider that sees personal data, a DPIA where the risk is high, and rules for staff. Data protection is the main brake on AI in German companies. In Bitkom's 2026 survey, AI users named data protection requirements as their top barrier (66%), and 45% feared company data falling into the wrong hands. In the DIHK's 2026 digitalisation survey, legal uncertainty was the biggest barrier to using data (59%).

The pressure also comes from tools already in use. The labour law firm Pöppel Rechtsanwälte pointed out in 2026 that when employees enter personal data into an AI tool for their work, the employer remains responsible for that processing, and that entering sensitive information into a generative AI tool can end trade secret protection under the GeschGehG. In IW Köln's 2026 survey, 29.1% of employees who use AI at work use tools their employer did not provide.

These are the questions that come up in trade press, law firm FAQs and IT forums:

• "Where is my data processed?"
• "Which data may go into the model at all?"
• "Who may do what, with which data, in which context?"
• "Do I need a processing agreement for ChatGPT Pro?"
• "Must I carry out a DPIA before every AI use?"
• "Is an Azure OpenAI instance in an EU region protected from the CLOUD Act?"
• "Are my prompts used for training with European model APIs?"
• "What should be logged, and what not?"

• Which data the use case needs. Classify it, for example public, internal, confidential, personal and special categories, and leave out what the use case does not need.
• Which deployment option each data class may use: a SaaS tool, your own cloud account or your own servers. A gateway, one controlled access point to all models, can enforce the rule, so different data goes to different models.
• What is logged: which fields, for which purpose, who can read them and for how long.
• Which contracts: a processing agreement under Article 28 GDPR with every provider that processes personal data on your behalf, and its sub-processor list.
• Whether a DPIA is needed: under Article 35 GDPR, where processing is likely to result in a high risk, before it starts.
• Rules for staff: which tools are approved for which data, and an approved tool so that private accounts are not the easier option.

The options differ in where prompts, documents, answers and logs are processed, and whose contracts and law apply to them.

• SaaS tool, such as a chat assistant bought per seat: prompts, uploaded documents and answers are processed on the provider's infrastructure. Retention, training use and the provider's own logs are set by its terms and admin settings, which sit outside your configuration. You rely on the processing agreement, the sub-processor list and those settings.
• Your own cloud account, such as Azure OpenAI or Amazon Bedrock: requests are processed by the model service under the cloud contract, identity and network you already manage, and the index, documents and logs stay in your account. Where requests are processed depends on the deployment type as well as the region. On Azure, a global deployment may route requests outside the region you chose, while an EU data zone deployment keeps processing within the EU. Both providers state that prompts and answers in these services are not used to train the models and are not passed to the model vendors. Azure applies abuse monitoring that can involve keeping data for a limited time.
• Your own servers: open-weight models, whose weights you can run yourself, serve requests in your data centre, and no prompt, document or log leaves your network. You carry operation and security, with the runbooks we hand over or with us running it under contract.

Data location and legal jurisdiction are different questions. Microsoft and Amazon are US companies, and an EU region does not by itself remove the reach of US law such as the CLOUD Act. For many companies, contracts, encryption and EU processing are enough. Where they are not for a data class, the answer is your own servers or an EU provider, enforced by the gateway's routing so that data class never reaches a US provider's model. This describes the technical side and is not legal advice. You make the call with your lawyers.

Every AI system logs something, and the logs are personal data as soon as they can be linked to an employee. The gateway, through which every model request passes, can record model, token counts, cost and time per request, and user or team IDs where the key carries them. Prompts and answers are stored only if that is switched on. We configure it as follows, and the settings go into the system documentation:

• Keys per team where the use case allows it, so cost is tracked without a personal identifier.
• Prompts and answers not stored by default. Where a use case needs them, for example to review errors, they are stored for an agreed purpose and period.
• Identifiers pseudonymised before storage, with any mapping back to a person held by a separate role.
• Retention set in the system, so logs are deleted automatically after the agreed period, including exports, the monitoring backend and backups.
• Access roles: operations staff see technical logs, finance sees cost per team, line managers see no per-person data.
• Traces of agent runs written to your own store.

• Personal data or trade secrets in prompts to unapproved tools: an approved assistant on company data, rules on data classes enforced in the gateway, and a usage review that shows which AI tools are paid for.
• Third-country access: data classes that must not be exposed to it go only to models on your own servers or with an EU provider, enforced by the gateway's routing.
• Training on your data: checked with you against each provider's current terms, recorded in the system documentation, and ruled out entirely on your own servers.
• Oversharing through search: an assistant can surface documents people should not see if permissions are not carried over. Permissions from SharePoint, file shares or your identity provider are applied at every search and tested before go-live.
• Agents with too many rights: each agent gets its own account with the least rights needed, writes only through approved tools, and every call is logged.
• Deletion: documents deleted at the source are removed from the index by update jobs, logs expire by their retention setting, and at the end of the contract data held by us is deleted or returned as the processing agreement sets out.
• Logs that turn into a monitoring tool: the field list and retention are agreed with the works council, and reports go out aggregated by team only.

Ask every provider, us included, for documents you can check rather than assurances:

• A data flow diagram from the user's screen to the model and back, marking every place data is stored or logged.
• A list of data categories per component, with storage location and retention period.
• The processing agreement and the full sub-processor list, including the model provider and hosting.
• The current training and retention terms of each model service used.
• The role and permission matrix, including who holds admin rights on the gateway.
• The technical and organisational measures: encryption, network isolation, permission enforcement and deletion procedures.
• Test results showing that permissions hold: nobody gets answers from documents they cannot open.

We provide the documents above as technical input for your DPIA and your records of processing activities. The legal assessment stays with you and your lawyers, and we do not write it. Where we process personal data on your behalf, we sign a processing agreement. We work only through the access you grant, and on your own servers data never has to leave your network.

Usually the IT head or the managing director brings you in. Ask for a free 30-minute call with an engineer: we walk through the data flow of the planned system and the deployment option that fits each data class. The call needs no access to systems and no data from you. If staff already use paid AI tools, the free AI usage review shows which ones, from exports aggregated by team or with names removed.