GDPR and AI

Why it applies

Sales data is full of personal data: contacts' names, phone numbers and emails, meeting notes, recordings. When an AI tool processes it, the GDPR applies exactly as it does to your CRM — the AI doesn't create an exception.

What to check

• A data processing agreement (DPA) with the provider, setting out what they may do with your data.
• Subprocessors: who else processes the data on the provider's behalf, and why.
• No training on your data unless you explicitly agree.
• Access control and security: encryption, isolation between customers, permissions per person.
• Minimisation and retention: only the data needed, kept only as long as needed.
• Rights: a clear way for people to access, correct or delete their data.

A practical rule for sales teams

Treat what reps say to an AI assistant — and the business cards they photograph — as CRM data. It belongs in a system with access control and an audit trail, not in personal chats.

Where emily fits

emily offers a DPA on request, publishes her subprocessors, never uses your conversations or meetings to train third-party models, and limits access per person, company and topic. See security and GDPR. This entry is general information, not legal advice.