Can You Use AI on Customer Data Under GDPR? A Baltic SMB Guide

Picture a simple plan: an AI assistant drafts replies to customer emails, or reads supplier invoices and enters them into your accounting tool. Then one question stops the project: is this even allowed under GDPR?

Short answer: usually yes, because GDPR does not ban AI. It asks the same questions it asks about any software that touches personal data: do you have a valid reason, have you told people, is the data protected, and do you know where it goes. The real risks are practical ones, such as sending data to a vendor on the wrong plan, without a contract, or to a region you never checked.

Scope and limits. This is general information for business owners, not legal advice, and it covers the EU General Data Protection Regulation (GDPR, official text on EUR-Lex) as of 19 October 2026, but not the EU AI Act. Article numbers below refer to that text; for convenience we link some of them to an article-by-article copy at gdpr-info.eu. Authorities and courts read some points differently, so for sensitive or high-volume data, ask a lawyer or your data protection officer.

What counts as personal data in an AI workflow?

Personal data is any information about an identified or identifiable living person (Article 4(1)). A name or email address is the obvious case, but a phone number, a delivery address, a customer number that points to one person, or a sole trader's bank account counts too. "Processing" is just as broad: reading, storing, sending or summarising the data all count.

Where it sits	What is inside	Easy to miss
Emails	Names, addresses, phone numbers, message text, attachments	Addresses like firstname.lastname@company.lv still identify a person, and so do old messages quoted further down the thread
Invoices	Contact persons, sole traders' names and addresses, personal bank accounts	Invoices to companies still name a contact person
CRM records (your customer database)	Names, phones, emails, deal history, notes	Free-text notes, which can hold health details, complaints or family matters
Forms and chats	Everything the person types, plus technical identifiers	Details people volunteer that you never asked for

Three points are worth keeping in mind:

Company data is not personal data, but the people named in it are.
Pseudonymised data is still personal data. Replacing names with codes lowers risk, but if you can link the codes back to people, GDPR still applies. Only truly anonymous data falls outside it (Recital 26), and that is hard to achieve with free text.
Some data is special. Health, religion, trade union membership, sexual orientation and a few other categories are prohibited by default unless an exception applies, such as explicit consent (Article 9). Free-text fields can contain these details even when you never asked for them.

Who is responsible: you or the AI vendor?

You are. In GDPR terms you are the controller, because you decide why and how customer data is used (Article 4(7)). The AI provider and the company hosting your workflow tool are usually processors: they handle data on your behalf and on your instructions.

Using a processor requires a written contract, usually called a data processing agreement (DPA). It must say that the vendor acts only on your instructions, keeps the data confidential and secure, asks for your approval before adding sub-processors (other companies it uses to deliver the service), helps with people's requests, and deletes or returns the data when the service ends (Article 28). The large AI vendors publish a standard DPA that you accept or sign online.

A good contract does not remove two duties that stay with you:

A valid reason for each use. GDPR lists six lawful bases, including contract, legal obligation, legitimate interests and consent (Article 6(1)). You may also use data only for purposes that fit why you collected it (Article 5(1)(b)). Answering a customer's own order email fits; feeding your whole customer list to an AI to profile buyers for marketing is a different purpose and needs its own check.
Telling people. Your privacy notice should name the recipients of the data, which includes an AI service provider, any transfer outside the EEA (the EU plus Iceland, Liechtenstein and Norway), and how long you keep the data (Article 13).

Where does the data actually go?

In most AI workflows, personal data passes through five stops. Each one is a place where a copy can be stored or moved abroad.

Stop	What happens there	What to check
1. Source (mailbox, accounting tool, CRM)	The data starts here, under your control	Who has access, and whether you need every field
2. Workflow tool (software that links your apps and runs automated steps, for example n8n)	Reads the data, passes it on, and may keep a copy in its run history	Where it runs, who can see the history, how long it is kept
3. AI model provider	Receives the text you send, processes it, and may log it for a limited time	Contract, use for training, region, retention
4. Other apps (email, chat, spreadsheets)	Receive the AI's output, which can contain personal data	Each one is its own processor with its own terms
5. Logs and backups	Copies in run history, error alerts and backups	How long they live and who can read them

Many businesses check stop 3 and forget stops 2 and 5.

What should you check before connecting an AI model?

Work through these seven steps before the first real customer record goes through.

Write the flow down on one page. List the data, where it comes from, each tool it passes through, and why. GDPR requires written records of processing (Article 30). The exemption for organisations under 250 people does not apply if processing is regular, risky or includes special-category data, so it rarely helps a business that handles customer data every day.
Send less data. Data minimisation is a core principle (Article 5(1)(c)). Strip signatures, mask bank account and ID numbers, and send only the part the AI needs. An automation can do this before the data leaves your system.
Use a business or API plan, not a free or consumer one. An API is the connection that software uses to send requests to an AI model, and vendors usually sell it under separate business terms, as the vendor table below shows.
Accept the DPA and read the sub-processor list. Check that you can object when the vendor adds a new sub-processor.
Check location and transfers. Find out where the data is processed and, if that is outside the EEA, what the legal route is (see the transfers section below).
Check retention at every stop. That means the AI vendor's logs, the run history in your workflow tool, and backups. Keep data for the shortest period that still lets you fix errors.
Keep a person in charge where it matters. Fully automated decisions with legal or similarly significant effects on a person, such as refusing a contract, are restricted (Article 22). A draft reply that a human approves is a different and much lower-risk use. AI can also be simply wrong, and wrong facts in a customer reply can breach the accuracy principle (Article 5(1)(d)).

Then update your privacy notice, tell staff which AI tools are approved, and agree who acts if something goes wrong.

What do the main AI vendors say about business data?

Vendor terms change often, and they differ between free, consumer and business products. This table is a snapshot as of 19 October 2026, based on each vendor's official pages. Check the current page before you sign anything.

Provider	Used to train models?	Location and retention
OpenAI (API and business products)	Not by default, and customers can opt in. A DPA is available (OpenAI business data).	API customers can choose Europe or the US for processing on supported endpoints. Europe has to be selected when a project is created and cannot be added to an existing one (EU residency). Abuse-monitoring logs are kept up to 30 days by default, and zero data retention is available by approval (API data controls).
Anthropic (Claude API, commercial terms)	The commercial terms, effective 17 June 2025, say Anthropic will not train on customer inputs or outputs. The DPA is incorporated into the terms (commercial terms).	API inputs and outputs are deleted from Anthropic's backend within 30 days by default, with exceptions such as legal requirements, usage-policy enforcement and separate zero-retention agreements (retention page, updated 1 July 2026). Check the processing location in the DPA.
Google (Gemini API)	Paid services: not used to improve Google products, and the DPA applies. Free tier: may be used to improve products and read by human reviewers (Gemini API terms, updated 28 April 2026).	Paid services log prompts and responses for a limited time to detect abuse, and may store or cache them in any country where Google or its agents operate.
Microsoft (Azure OpenAI in Foundry)	Prompts and completions are not shared with other customers or OpenAI, and are not used to train foundation models without your permission (Microsoft Learn, updated 19 May 2026).	Data at rest stays in your chosen geography. "Standard" deployments process within that geography, "Global" ones anywhere the model runs, and "DataZone" within a zone such as the EU. A sample can be reviewed for abuse monitoring unless you are approved for modified monitoring.

The pattern is that one company often has separate rules for free or consumer apps and for business or API products. Google's own terms make the split explicit: free-tier prompts may be read by human reviewers. The simplest rule is no customer data in personal or free AI accounts.

Is it a problem if the AI provider is American?

Not automatically, but you need a legal route. GDPR allows personal data to leave the EEA on a few bases: an EU adequacy decision, appropriate safeguards such as standard contractual clauses (SCCs), or narrow exceptions (Articles 44 to 49).

For US companies, the main route is the EU-US Data Privacy Framework. The European Commission adopted an adequacy decision for certified US companies on 10 July 2023 (European Commission). The EU General Court rejected a challenge to it on 3 September 2025 (IAPP), but an appeal was filed at the Court of Justice and, as far as we could find, it has not been decided (StreamLex tracker).

So choose a vendor that relies on the framework and also offers SCCs in its DPA, and prefer an EU region where one exists. EU hosting reduces transfer questions, but it does not replace the other checks: you still need a lawful basis, a DPA and data minimisation.

Will self-hosting n8n solve the problem?

Self-hosting n8n helps with one layer, the workflow tool. It does nothing for the AI step, and it makes security your job.

Where self-hosting helps

Workflow data stays on your server. For self-hosted instances, n8n's privacy documentation says the data flowing through your workflows stays on your infrastructure and n8n never receives it. Telemetry (usage data sent back to the vendor) is on by default but does not cover that data, and N8N_DIAGNOSTICS_ENABLED=false turns off diagnostics (telemetry settings). Usage reporting for paid licences cannot be disabled.
You control the run history. n8n stores execution data for each run. You can skip saving successful runs with EXECUTIONS_DATA_SAVE_ON_SUCCESS, and pruning is on by default, deleting runs older than 336 hours (14 days) (execution data docs).
You choose the country and the host. For workflow data you also have one fewer company in the chain, because n8n describes itself as neither controller nor processor for it on self-hosted instances.
It pairs with a model on your own servers. If the AI model also runs on your infrastructure, personal data never leaves it. That takes hardware and skills, and quality varies by task.

Where it does not help

The AI call still leaves your server. If the workflow sends text to a hosted model, that vendor's DPA, region and retention still decide the risk.
Security becomes your job. You handle patching, backups, encryption, access control and testing (Article 32). A neglected server can be riskier than a reputable cloud service.
Breach handling lands on you. You must notify the supervisory authority within 72 hours of becoming aware of a reportable breach (Article 33). On a server you run yourself, nobody else will tell you it happened.
Run history is still personal data. Leaving it on your server forever means keeping data longer than you need.
n8n Cloud is not automatically a problem. n8n offers a DPA that, according to its privacy page, includes SCCs, and a Trust Center. The documentation we checked does not state where Cloud data is hosted, so confirm that before you choose it.

	Self-hosted n8n	n8n Cloud
Who runs the servers	You	n8n
Where workflow data sits	Your server	n8n's hosting (confirm the region)
Contract for workflow data	None with n8n	DPA with n8n
Updates and security	You	n8n handles hosting and updates (n8n docs)
Best when	You handle sensitive data and have someone to run and patch the server	You have no IT capacity, the data is low-risk, and the DPA, region and run-history settings are checked

Either way, the biggest gains come from sending less data and fixing the AI step.

What does a safe setup look like?

Imagine a small Riga company (a hypothetical example) that wants AI to read supplier invoices.

In the safer setup, a workflow reads invoices from a dedicated mailbox and removes everything except supplier name, invoice number, date, amounts and line items. It sends only that to an AI API on a business plan, with a signed DPA and an EU region. Successful runs are not saved, unusual invoices go to a person for approval, and the company records the flow on one page and adds "AI service providers" to its privacy notice.

In the risky setup, someone forwards whole emails, with signatures and bank details, to a free chatbot account, and nobody knows how long they are stored. The task is the same, but there is no contract, no control and no record. The difference is the setup, not the technology.

When is AI not the right answer?

Sometimes the honest answer is to keep AI out of the loop, or to keep it away from certain data.

Special-category data in free text. Clinics, salons, therapists and HR files often hold health or similar details. These need an Article 9 exception and a careful assessment, and it is often better to keep that data out of the AI step or run it on your own infrastructure.
Decisions about people. Credit, hiring and refusing service should stay with a human who can explain the decision.
Likely high-risk processing. Large-scale or new-technology uses may need a data protection impact assessment (DPIA) before you start (Article 35). Latvia's Data State Inspectorate (DVI) publishes a list of processing types that need one (in Latvian, adopted 18 December 2018) and a DPIA page. A small email-drafting automation is often low risk, but that is a judgement to make and write down.
Unclear vendor terms. If you cannot find the contract, region or retention, do not connect it yet.
Work where accuracy matters. AI drafts can contain errors, so a person should review anything that goes to a customer.

What if something goes wrong?

If personal data is lost, leaked or accessed without permission, you generally must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. No notice is needed if the breach is unlikely to put people at risk (Article 33). Your processors must tell you without undue delay.

In Latvia, DVI accepts breach notifications through an online form (sign-in via Latvija.lv), an e-address or email (DVI, in Latvian). Estonia's authority has its own breach notice page (in Estonian), and Lithuania's State Data Protection Inspectorate publishes guidance on its site.

Fines have two ceilings: up to €10 million or 2% of worldwide annual turnover for duties such as security, records and breach notification, and up to €20 million or 4% for breaches of core principles, people's rights or transfer rules, whichever is higher (Article 83). These are maximums, not typical amounts.

GDPR is the same law in all three Baltic states, but the authorities and national supplementary rules differ. Latvia's Personal Data Processing Law (in Latvian), for example, adds conditions for processing special categories of data and names DVI as the supervisor.

Key takeaways

GDPR does not ban AI. It asks for a valid reason, transparency, security and control over where data goes.
Emails, invoices and CRM records almost always contain personal data, including inside free-text fields.
The AI vendor is your processor: use a business or API plan, accept the DPA, and check sub-processors, region and retention. Keep customer data out of free and consumer accounts.
Self-hosting n8n gives you control of the workflow layer and its run history, but it does not change what the AI vendor receives, and it makes security and breach handling your job.
Send less data, keep a person in charge of decisions that affect people, and write the whole flow down on one page.

FAQ

Do we need customers' consent before using AI on their data?

Not always. Consent is only one of six lawful bases, and contract or legitimate interests often fit (Article 6(1)). You still need a valid basis and must inform people, and special-category data needs an Article 9 exception.

Can we paste customer emails into a public chat tool?

Not on personal or free accounts. Their terms differ from business plans, and a free tier may allow product improvement use and human review. Use a business plan with a DPA and remove the personal details you do not need.

Do we need a DPIA?

Only where processing is likely to create a high risk for people (Article 35(1)), such as large-scale special-category data or significant automated decisions. Many small automations will not need one, but check the DVI list and note your reasoning.

Is EU hosting of the AI model enough?

No. It addresses where data is processed, but you still need a lawful basis, a DPA, data minimisation, retention limits and an updated privacy notice.

Will the EU's Digital Omnibus change these rules?

The European Commission proposed changes to GDPR in November 2025. As of 24 September 2026, a policy tracker reports the GDPR part was still being negotiated with no final text, so today's GDPR applies unchanged.

Not sure what an AI automation would touch in your business? Book a free 20-minute call or send us a short description of the process, and we will tell you what can be automated and what to check on the data side first.