https://www.velado.app/en/blog/Practical guides for accountants, auditors and lawyers who want to use AI with client documents without breaching professional secrecy or the GDPR.en Sat, 14 Nov 2026 09:00:00 GMT https://www.velado.app/en/blog/ai-gdpr-data-transfers-united-states/https://www.velado.app/en/blog/ai-gdpr-data-transfers-united-states/Sat, 14 Nov 2026 09:00:00 GMTNearly always, yes: when you use an AI service from a US company, data may be processed in the US or be accessible from there. The GDPR allows it if the provider is certified under the Data Privacy Framework or standard contractual clauses are in place. But a lawful transfer does not answer the confidentiality question: the data is still disclosed to a third party. If you only send pseudonymised data, the AI never learns who the client is. https://www.velado.app/en/blog/microsoft-365-copilot-professional-confidentiality/https://www.velado.app/en/blog/microsoft-365-copilot-professional-confidentiality/Sat, 14 Nov 2026 09:00:00 GMTIn Microsoft 365 Copilot with a business licence, prompts and responses stay inside the service, with Microsoft as processor, and are not used to train models. Three limits matter: web searches go to Bing under different rules, Copilot shows each person everything they already have access to, and free or personal versions do not carry these commitments. https://www.velado.app/en/blog/anonymise-excel-tax-numbers-before-using-ai/https://www.velado.app/en/blog/anonymise-excel-tax-numbers-before-using-ai/Sat, 14 Nov 2026 09:00:00 GMTReplace every tax number, name, IBAN and address with a code that is always the same for the same party (one client is always <code>[ENTIDADE_1]</code>), leave amounts and account codes untouched, and keep the lookup table on your own computer. Deleting columns or using Find and Replace is not enough: it misses numbers stored as numbers, hidden sheets, comments and the file name itself. https://www.velado.app/en/blog/ai-use-policy-template-accounting-law-firms/https://www.velado.app/en/blog/ai-use-policy-template-accounting-law-firms/Sat, 14 Nov 2026 09:00:00 GMTAn AI policy for a small firm fits on one page and answers six questions: which tools may be used, which data never leaves the firm, how documents are prepared before they are sent, who reviews the output, what is recorded and what the client is told. Below is a template you can copy and adapt. https://www.velado.app/en/blog/ai-and-professional-secrecy/https://www.velado.app/en/blog/ai-and-professional-secrecy/Tue, 10 Nov 2026 09:00:00 GMTYou can use AI at work, but you can't hand an outside service the client facts and documents your secrecy duty protects without the client's consent. The safe way is to remove everything that identifies the client before sending (tax IDs, names, IBANs, addresses) and restore the data at the end, on your own computer. https://www.velado.app/en/blog/pseudonymisation-vs-anonymisation-gdpr/https://www.velado.app/en/blog/pseudonymisation-vs-anonymisation-gdpr/Tue, 10 Nov 2026 09:00:00 GMTAnonymisation makes identifying the person impossible, irreversibly: the data stops being personal data. Pseudonymisation swaps identifiers for codes and keeps the key separately: it's reversible and the data is still personal under the GDPR, but risk drops sharply and the law recognises it as a security measure. https://www.velado.app/en/blog/chatgpt-trial-balance-saft-without-exposing-clients/https://www.velado.app/en/blog/chatgpt-trial-balance-saft-without-exposing-clients/Tue, 10 Nov 2026 09:00:00 GMTBefore sending, replace every identifier (tax IDs, customer and supplier names, IBANs, addresses) with consistent codes, keeping amounts and account codes. Ask the AI for the analysis on the coded file. At the end, restore the real data in the answer, on your computer.