AI and GDPR in a small company: customer data and simple safeguards

GDPR with AI is, above all, data discipline

In a small company, GDPR compliance with AI rarely requires a big budget. It requires discipline: awareness of what data goes into the tool, where it ends up, and who can access it. Data privacy with AI starts not with a system but with a decision about what you never put into that system in the first place.

The starting point is simple: the model only needs the data that the task actually requires. Anything beyond that is needless risk.

What not to paste

Before you paste anything into an AI tool, check whether the task really needs it. By default, don't paste:

• National ID numbers, ID cards, or data from identity documents.
• Sensitive data (health, biometric data, opinions).
• Full customer databases when a single record is enough for the task.
• Trade secrets and data covered by confidentiality agreements, without first checking the tool's terms.

If the data is needed but identifying the person isn't, remove or mask the identifying fields before sending. It's the cheapest safeguard there is: minimize the input.

Simple safeguards on an SME budget

A few cheap steps you can put in place right away close off most of the risk.

Safeguard	What it does	Cost
Data minimization	Less data in = less risk	None
Guardrails	Rules for what the model may not accept or return	Low
Usage log	A record of who sent what to the tool	Low
Roles and access	Only the right people get the right data	Low
Tool choice	A provider that doesn't train on your data	A choice, not a cost

Guardrails are a set of rules imposed on the tool — for example, blocking the pasting of national ID numbers, or barring the return of data outside the allowed scope. They work like a fuse and don't take much effort.

Watch out for prompt injection

There's one risk small companies often don't know about. Prompt injection is an attack in which a malicious command is hidden inside content the model processes — for instance, in an email, a document, or on a web page. The model may treat it as an instruction and do something you never intended, such as disclosing data.

That's why an assistant working on third-party content (emails, attachments, forms) shouldn't have unsupervised access to sensitive operations. A human in the loop and guardrails limit the damage from such an attack.

Operator's rule: treat every piece of outside content as a potentially hostile instruction, not just as data. That changes how you design the whole process.

Lightweight governance you can actually maintain

You don't need a formal thirty-page policy. You need AI governance sized for your company: a short, one-page rule that states which data must never be pasted, who owns the tool, and how to report a problem. One page that everyone follows is worth more than a thick document in a drawer.

Add two habits to that: review the usage log every so often, and have a quick conversation with the team before anyone connects a new tool to company data.

What to do this week

Three steps that close off most of the risk with no budget:

1. Write down, on one page, which data must never be pasted into AI tools.
2. Turn on the guardrails you have, and check that the provider doesn't train on your data.
3. Decide who owns the tool and how to report a problem.

GDPR compliance with AI in a small company isn't a quarter-long project. It's a handful of decisions and habits you can adopt on the spot, with broader governance added only as you scale.