GDPR and
workplace AI.
Under the GDPR, personal data pasted into an AI tool is still processing that needs a lawful basis and appropriate safeguards. PromptGlass detects and redacts personal data in prompts, keeps monitoring data in the EU, and is built to respect employee privacy too.
Requirement mapping
How PromptGlass supports GDPR
An indicative mapping of themes in the framework to PromptGlass capabilities. Your auditors and counsel determine what applies to you.
| Theme | How PromptGlass helps |
|---|---|
| Data minimization | ✓Redaction removes personal data from prompts before they reach the model. |
| Restrictions on transfers | ✓Policies block or reroute data classes to providers and regions you approve. |
| Employee privacy in monitoring | ✓Pseudonymization, metadata-only modes, four-eyes re-identification and EU-region hosting. |
| Records of processing | ✓An inventory of AI tools that process personal data, with volumes per data class. |
This page is general information, not legal advice. Using PromptGlass does not by itself make an organization compliant with GDPR.
GDPR and AI usage: FAQ
Is monitoring employees’ AI use compatible with the GDPR?
+
It can be, with a legitimate purpose, transparency, proportionality and, where required, works council agreement. PromptGlass offers privacy-preserving modes to support that. Your DPO should assess your specific setup.
Find out how your company really uses AI.
Start a free 30-day AI usage assessment: a complete shadow AI inventory, the sensitive data leaving, and the AI seats you are paying for but not using.