Data, privacy and GDPR: the rules of the game

This is the topic that can prove costly if ignored, and yet it boils down to a few clear rules.

The basic reflex: nothing identifying in a consumer tool

When you use the free version of an assistant, your texts may be used to improve the service. So: never put identifiable client data in a consumer tool. No "Draft a follow-up for Mr Bernard Martin, 12 rue des Lilas, who owes €3,400." Instead: "Draft a follow-up for a client who has owed about €3,000 for two months." You then personalise it in your usual software.

What the GDPR says, in one sentence

You remain responsible for the personal data of your clients and employees: handing it to a tool that reuses it without a legal basis can be held against you, with fines at stake. The upside: anonymising before pasting is enough in the vast majority of office use cases.

The serious options when needs grow

• The business tiers of the major assistants contractually commit not to train their models on your data.
• European players such as Mistral offer solutions that can be hosted in Europe, a strong argument for sensitive sectors.
• Worth noting: the European AI Act is gradually imposing transparency obligations on AI providers; for a small business using these tools, the GDPR remains the key concern.

Three instructions to give your team as of tomorrow

• Anonymise everything you paste into an AI (no names, no contact details, no numbers).
• Never paste an entire confidential document (signed contract, payroll, health data).
• When in doubt, ask the person in charge before pasting.