Regulation
AI and GDPR for small businesses: what you actually need to know
You do not need to be a lawyer to use AI legally. Here is what actually matters when a small business starts using AI tools, in plain language.
Most small businesses can use AI entirely legally, but there are a few simple things to keep track of. This is not legal advice, but what you practically need to think about.
GDPR cares about personal data, not AI
GDPR is about personal data: names, email addresses, personal ID numbers, customer data. Are you writing a poem or summarising a public report with AI? Then GDPR is rarely involved. Are you pasting in a customer list or a CV? Then the rules apply.
Rule of thumb: do not feed personal data into AI tools unnecessarily, and especially not sensitive data (health, personal ID numbers) into free tools.
Where does the data end up?
This is the most important question, and the one we flag on every tool. Many popular AI tools store data in the USA. Then US authorities can in some cases request it via the CLOUD Act if the supplier is American, even if the server happens to be in the EU.
For ordinary marketing text it matters little. For customer data or sensitive data, a Swedish or European tool is a safer choice. If you want an AI chat within the EU, Mistral is a good example, and for bookkeeping Bokio keeps data within the EU. For secure email, Proton is a strong choice: Swiss rather than EU, but Switzerland has the EU’s approval for data protection (adequacy decision) and is not covered by the CLOUD Act.
Do you need a data processing agreement (DPA)?
If a tool processes personal data on your behalf, you should have a DPA (data processing agreement). Most serious suppliers offer it, often with one click in the settings. We note which ones do.
Simple checklist
- Do not feed in more personal data than necessary.
- Avoid sensitive data in free tools.
- Check where data is stored. Choose EU/Swedish for sensitive.
- Sign a DPA if the tool handles personal data on your behalf.
- Tell customers if you use AI that makes decisions about them.
Want to dig deeper into the rules? See our overview of data protection and EU regulations. And try the selector tool to find tools that keep data within the EU.
Sources
Tools mentioned
Mistral (Le Chat)
Mistral AI
France's answer to ChatGPT and one of the few European AI models in the top class, with EU data storage.
- European model in top class
- EU data storage
- Slightly weaker than the largest American ones
Best for: Those who want a powerful AI chat within the EU.
Proton Mail
Proton
Encrypted email from Switzerland, built for privacy. Popular European alternative to Gmail and Outlook.
- Strong encryption and privacy
- Data is processed by default in Switzerland, which has an EU adequacy decision
- Switzerland is outside the EU (but has an adequacy decision)
Best for: Businesses that want secure email outside the American giants.
Bokio
Bokio
Swedish accounting program from Gothenburg that reads receipts and books automatically. Affordable and simple, but the old free tier is now a 14-day trial.
- Reads receipts and books automatically
- Simple interface, built for non-accountants
- No longer free, subscriptions from SEK 269/month
Best for: Sole traders and small businesses that want to handle accounting easily themselves.
Related articles
This is general information, not legal advice. See How we review.