The VIFLY guide France · European Union
Before the prompt, look at the data.
A convenient file to summarise may contain names, professional secrets or sensitive information. Your first decision concerns what you send and to whom.
Sources checked on 23 October 2026
The short answer
Personal data and GDPR
GDPR still applies when AI processes personal data. Check the purpose, lawful basis, necessity of the data, service contract and security safeguards. Consent is not the only possible basis, and a paid subscription alone does not make processing compliant.
These guideposts distinguish the status of a rule; 'Pause and check' calls for review before acting.
Reduce before you send
The file
Identify people and secrets.
The filter
Remove, minimise, validate the framework.
The result
Check before any reuse.
From rule to practice
What does that look like in practice?
A client spreadsheet
The file contains names, orders and contact details.
Validate the purpose, service and GDPR framework; send only necessary columns.
A medical file to summarise
The document describes an identifiable patient.
Do not send the file to an unapproved tool. Have the framework for health data and professional duties checked.
A fully fictional example
You want to test an email with invented names and situations.
This is a useful way to test without exposing real clients. Check that no real details remain.
Recognising personal data
A name, address, identifiable voice or face is personal data. Text without a name can also identify someone through their job, story or a combination of details. Health data and other sensitive categories require additional care and legal conditions.
Replacing a name with 'Client A' does not guarantee anonymity. Pseudonymisation still allows re-identification; genuine anonymisation requires identification to no longer be reasonably possible. Also remove unnecessary indirect details.
Checking the service and account
Check who processes the data, for what purpose, where it is hosted, how long it is retained and whether it can be reused to train models. Review account settings, the data processing agreement where that role applies and any transfers outside the European Economic Area.
A 'private' mode or an option disabling training addresses only part of the issue. It does not replace analysis of your processing, information for people or access security. Avoid pasting confidential data into a consumer service without an approved framework.
Defining a necessary and proportionate use
Document the concrete need and appropriate lawful basis. Do not automatically request consent if another basis is relevant, and do not assume your contract authorises every use. Limit data to what is necessary, set a retention period and plan for people to exercise their rights.
For uses presenting a high risk to people, a data protection impact assessment may be needed. Automated decisions producing legal or similarly significant effects require specific analysis. AI must not become a way to bypass applicable protections.
A safer workflow
To draft an example, prefer clearly identified fictional data. To summarise a real file, start with the authorised scope and data reduction. Check the result: a model may invent information or reveal a detail you did not intend to publish.
If an AI agent can read files, send messages or edit records, limit its access and require appropriate human approval before consequential actions. Separate tests from real data and keep an operations log.
Before taking action
Your essential checks.
A preparation aid, with no automatic compliance verdict.
Getting to the point
Questions people often ask.
Can I just replace names with initials?
It may reduce exposure, but it is not necessarily anonymisation. Context and indirect details may still identify the person.
Does a business plan guarantee GDPR compliance?
No. It may provide useful safeguards, but you must check the contract, settings and your own use. Compliance also depends on your purpose, data and people's rights.
Sources and method
The sources behind the answers.
Editorial team: VIFLY. Documentary checks on 23 October 2026. This guide is an educational summary without individual legal validation. The links let you consult the text and its conditions.
- CNILUsing a generative AI system: questions and answers Official explanation
- CNILAI and personal data protection Official explanation
- CNILAnonymisation and pseudonymisation: differences Official explanation
- CNILAI: informing affected people Official explanation
- CNIL / CIANumAgentic AI and data protection — July 2026 Report / analysis
- CNILData protection impact assessment Official explanation
Understand, then practise
Clear rules. Useful applications.
Explore AI courses and VIFLY resources to build a more considered practice.