Regulation
AI and GDPR for small businesses: what you actually need to know
You do not need to be a lawyer to use AI legally. What trips up a small business is rarely the advanced legal questions, but the everyday habits around what gets pasted in, and where. We go through them, one at a time.
Most small businesses can use AI entirely legally, but there are a few simple things to keep track of. This is not legal advice, but what you practically need to think about.
GDPR cares about personal data, not AI
GDPR is about personal data: names, email addresses, personal ID numbers, customer data. Are you writing a poem or summarising a public report with AI? Then GDPR is rarely involved. Are you pasting in a customer list or a CV? Then the rules apply.
The most important rule: do not feed personal data into AI tools unnecessarily, and especially not sensitive data (health, personal ID numbers) into free tools.
Where does the data end up?
This is the most important question, and the one we flag on every tool. Many popular AI tools store data in the USA. Then US authorities can in some cases request it via the CLOUD Act if the supplier is American, even if the server happens to be in the EU. More on the mechanisms is in our overview of data protection and EU regulations.
For ordinary marketing text it matters little. For customer data or sensitive data, a Swedish or European tool is a safer choice. If you want an AI chat within the EU, Mistral is a good example, and for bookkeeping Bokio keeps data within the EU. For secure email, Proton is a strong choice: Swiss rather than EU, but Switzerland has the EU’s approval for data protection (adequacy decision) and is not covered by the CLOUD Act.
Do you need a data processing agreement (DPA)?
If a tool processes personal data on your behalf, you should have a DPA (data processing agreement). Most serious suppliers offer it, often with one click in the settings. We note which ones do.
Simple checklist
- Do not feed in more personal data than necessary.
- Avoid sensitive data in free tools.
- Check where data is stored. Choose EU/Swedish for sensitive.
- Sign a DPA if the tool handles personal data on your behalf.
- Tell customers if you use AI that makes decisions about them.
Boil the checklist down to a single rule and it is this: for texts, ideas, and other non-sensitive material almost any tool works, but the moment customer data or sensitive material is involved, an EU tool with a signed DPA is the only path that holds up. It is that line, not the choice of tool itself, that determines whether you are doing it right.
Five points, no complications. Make the checklist a habit and you have covered what actually matters for a small business.
Sources
Tools mentioned
Mistral (Le Chat)
Mistral AI
France's answer to ChatGPT: the AI chat Le Chat from Mistral AI in Paris, one of the few European models in the top class. Data is stored within the EU, with a GDPR data processing addendum and certifications for SOC 2 Type II as well as ISO 27001 and 27701. A free tier is available to start with.
- European model in the top class, developed by Mistral AI in Paris.
- Data storage within the EU, with a GDPR processing addendum and certifications for SOC 2 Type II as well as ISO 27001/27701.
- Does not quite reach the level of the largest American models.
Best for: A Swedish consultant or agency that wants a powerful AI chat for quotes and emails without handing data to an American provider.
Proton Mail
Proton
Encrypted email from Proton AG in Geneva, built for privacy and a popular European alternative to Gmail and Outlook. Data is processed by default in Switzerland under Swiss law, with a GDPR representative in the EU. There is a permanent free plan, and the paid plans come with a 14-day free trial.
- Strong encryption and privacy focus under Swiss jurisdiction.
- Data is processed by default in Switzerland, which has an EU adequacy decision.
- Switzerland is outside the EU, even though the country has an adequacy decision.
Best for: A business that wants to move its email away from the American giants without leaving Europe, for example a consultancy handling sensitive client data.
Bokio
Bokio
Swedish accounting program from Gothenburg that reads receipts and books automatically. Affordable and simple, but the old free tier is now a 14-day trial.
- Reads receipts and books automatically
- Simple interface, built for non-accountants
- No longer free, subscriptions from SEK 269/month
Best for: Sole traders and small businesses that want to handle accounting easily themselves.
Related articles
This is general information, not legal advice. See How we review.