GUIDE · GDPR · EU AND UK

GDPR and AI chatbots: a practical checklist for freelancers and small teams

GDPR does not ban AI tools. It asks you to process only the personal data you need, protect it, and be able to say where it went. The simplest way to stay on the right side is to send the AI less personal data in the first place.

This is a practical checklist, not legal advice. Your obligations depend on your role, your contracts and your jurisdiction.

The principles that apply

• Data minimisation (Article 5(1)(c)): process only the personal data you need for the purpose. An AI drafting a reply does not need the client's IBAN.
• Security of processing (Article 32): pseudonymisation is named as an appropriate measure.
• Processors (Article 28): if personal data you are responsible for reaches an AI provider, that provider processes it on your behalf, which normally calls for a data processing agreement.
• International transfers (Chapter V): most AI providers process data outside the EU; check how the transfer is covered.

Checklist

1. Know your role. For client data you usually act as the client's processor. Check your contract: some forbid sending their data to any third-party service.
2. Choose the account type deliberately. Business and API plans generally offer a data processing agreement and exclude training by default; consumer plans often do not.
3. Turn off training on any account you use for work, and note the retention period.
4. Remove direct identifiers before sending. Names, emails, phone numbers, addresses, account and ID numbers. Replace them with consistent placeholders so the text still makes sense.
5. Keep the key on your side. The mapping from placeholder to real value should stay on your device, not in the AI conversation.
6. Watch the indirect identifiers. A rare job title plus a small town plus a date can identify a person. Generalise where it does not change the answer.
7. Do not send special category data (health, religion, ethnicity, sexual orientation, criminal records) unless you have a clear legal basis and the client's agreement.
8. Document it. One line in your record of processing: which tool, which account, what you remove before sending.
9. Tell clients. A sentence in your terms or a quick email: you may use AI tools, and you remove personal data before doing so.

Where Scrub fits

Steps 4 and 5 are what Scrub automates. It replaces identifiers with stable placeholders on your device, keeps the mapping locally, and restores the details in the AI's answer. It works on pasted text, in AI chat sites through the browser extension, in any desktop app through the clipboard, and on .docx files.

Pseudonymised data is still personal data under GDPR while you hold the mapping. The benefit is practical: the AI provider receives and retains far less about the people involved, and a leak of that conversation exposes placeholders instead of names.