GDPR
AI and the GDPR: does my clients' data go to the United States?
By Hugo Ribeiro · Updated · 7 min read
The AI assistants most firms use come from US companies. Anyone handling clients' personal data needs to know where it goes and on what basis. This guide covers the essentials; it does not replace reading your provider's contract.
When there is a transfer
The GDPR (Chapter V, Articles 44 to 49) only allows personal data to leave the European Economic Area if the destination offers adequate protection or appropriate safeguards are in place. A transfer happens when data is stored or processed outside the EEA, and also when it is made accessible from there.
The two bases used most
1. Data Privacy Framework
Implementing Decision (EU) 2023/1795 of 10 July 2023 treats US companies certified under the EU-US Data Privacy Framework as offering adequate protection. You can check whether your provider is certified on the official list. The General Court upheld the decision in September 2025; an appeal is pending before the Court of Justice. The two earlier regimes, Safe Harbor and Privacy Shield, were both struck down, the second in Schrems II in 2020.
2. Standard contractual clauses
If the provider is not certified, or as a second safety net, the Commission's standard contractual clauses apply (Article 46). They normally come inside the data processing agreement of business plans. Since Schrems II the exporter must assess whether supplementary measures are needed; the European Data Protection Board gives pseudonymisation as an example of an effective one, provided the key stays with the exporter.
What to check with your provider
- Plan. Free and personal plans generally have no data processing agreement. Use a business plan.
- Data processing agreement (Article 28): is there one, and what does it say about transfers?
- Training. Is your data used to train models? On business plans the default is usually no.
- Location and sub-processors. Where the data sits and who else can reach it.
- Retention. How long conversations and files are kept.
Why this is not enough for confidentiality
The GDPR asks whether the processing is lawful and secure. Professional confidentiality asks something else: whether you may disclose that fact to that third party. A certified provider with a contract and European servers is still a third party. See AI and professional secrecy.
The practical answer: send without identifying
If the document leaves the firm with codes in place of tax numbers, names, IBANs and addresses, and the lookup table stays on your computer, the provider receives data it cannot link to anyone. The transfer still needs a legal basis, but far less is at stake, and the confidentiality question no longer arises in the same way. That is the difference between pseudonymisation and anonymisation put to work for you.
Velado does that step on your computer and restores the data in the answer. You can try it in the browser and put the rule in writing with the AI policy template.
FAQ
Is the Data Privacy Framework in force?
Yes. The European Commission adopted the adequacy decision on 10 July 2023 and the EU General Court upheld it on 3 September 2025 (Latombe v Commission). An appeal was lodged with the Court of Justice; when this guide was written we had no confirmation of a final ruling. Worth watching.
If the provider stores data in Europe, is there no transfer?
EU storage reduces the issue but does not always remove it: there may be remote access from outside the EU for support or security, and some sub-processors sit elsewhere. Read the data processing agreement and the sub-processor list for the plan you bought.
Does pseudonymisation replace the contract with the provider?
No. Pseudonymised data is still personal data for whoever holds the key, which is your firm. You still need a provider with a processing agreement. What changes is the risk: the provider receives codes and amounts without knowing whose they are.
What about UK firms?
The UK has its own regime: the UK GDPR and the UK-US data bridge, an extension of the Data Privacy Framework. The logic is the same; check that your provider is certified for the UK extension.
Try it with your own document
Velado runs in your browser, on your computer: nothing is sent to any server.