Privacy and personal data
In brief
What you type or send to an AI assistant may be stored, reviewed or used to improve the service. In Europe, the GDPR governs this processing; a few simple habits limit the risks.
Definition
Personal data is any information that can identify a person, directly or indirectly: name, email address, photo, voice, customer number, but also a set of details that, combined, point to someone. When you use an AI assistant, your messages, your files and sometimes your voice are sent to its provider.
What can happen to your data
- Retention: conversations are often kept for a certain period.
- Model improvement: depending on the plan and your settings, they may be used to train future versions.
- Human review: some providers have part of the conversations reviewed for quality or safety.
- Transfers outside Europe: many services process data in the United States or elsewhere.
The European framework
The GDPR requires a legal basis, clear information, data minimisation and rights for everyone: access, rectification, erasure, objection. The EU AI Act adds transparency and risk-management obligations. National authorities, such as the CNIL in France, publish guidance on using AI.
Good habits
- Do not paste sensitive data (health, customer details, passwords, confidential documents) into a consumer assistant.
- Check in the settings whether your conversations are used for training, and turn it off if needed.
- For professional use, prefer business plans, which usually include contractual commitments on data, or an open model hosted on your own infrastructure.
- Anonymise or replace names before sending a document.
- Limit connectors' permissions to the folders they actually need.
Spotted a mistake or have an idea about this entry? Let us know