AI and GDPR: where your data goes when you automate documents

Data handling must be defined during the initial analysis, before a line of code is written: what enters the flow, where it is processed, how long it is kept and who can see it. A vendor who cannot answer these questions in the proposal will not answer them later.

For a professional bound by confidentiality, or for anyone processing third-party data, this is not red tape: it is the perimeter within which automation is allowed to exist.

The large cloud models (Google's Gemini, including through Vertex AI, Mistral, OpenAI) offer the highest quality with the least infrastructure effort. Data passes through the vendor's servers under its contractual terms, which must be read and assessed: processing region, use for training, retention periods.

A middle ground is running the model inside a dedicated cloud area, in an EU region and with contractual no-training guarantees, as some enterprise platforms allow.

The third option is running the model locally, on your own servers or a dedicated one, for example with Ollama. Documents never leave your infrastructure.

A local model is smaller than the cloud ones and generally less capable on open-ended tasks. But on a well-defined task, such as extracting a dozen fields from a known type of document, a smaller model often matches the quality of a larger one at a fraction of the cost.

That is why in every project we benchmark the candidate models on the client's real documents, measuring quality and cost, and pick the best trade-off. When documents cannot leave your systems, the benchmark is run among local models.

The GDPR requires processing only the data that is necessary and keeping it only as long as necessary. Applied to document automation this means: send the model only the parts of the document needed for extraction, keep no intermediate copies without reason, define a retention period for logs and stick to it.

The confidence score and human review belong to the same picture: decisions with significant effects on people are not taken by the model alone.

Five questions are enough to tell a serious project apart: which models do you use and where do they run; is my data used for training; in which region does processing happen; how long do logs and copies persist; who is the data processor and under which contract.

We define our answers with you during the initial analysis. The handling of data collected by this website is described in our Privacy Policy.