What exactly leaves the building
The database stays in-house. What a language model needs is the content of an individual request and the context that a tool passes along. Exactly this excerpt goes to the model provider, and exactly there is where protection applies: masking, limiting, securing by contract.
Onagero says this openly: the platform runs on your server, the language model at the model provider. Only the excerpts that a request needs leave, in approved and masked form. The data path in detail.
What the GDPR requires
- Legal basis (Art. 6 GDPR): for every processing of personal data, including by an AI tool.
- Data processing (Art. 28): a contract is needed with every service provider that processes personal data on your behalf. This concerns the platform operator and the model provider.
- Transfer to third countries (Art. 44 et seq.): if the model provider is based outside the EU or processes data there, a basis is needed, such as an adequacy decision or standard contractual clauses.
- Data protection impact assessment (Art. 35): where processing is likely to result in a high risk, for example in extensive evaluation of employee data.
- Information obligations (Arts. 13, 14): data subjects must know that and how their data is processed.
Pseudonymised is not anonymous
The GDPR distinguishes precisely: pseudonymised data (Art. 4(5)) can be attributed to a person again with additional information and therefore remains personal data (Recital 26). Only truly anonymous data falls outside the scope.
Masking, as Onagero uses it in the analysis copy, is an effective technical measure: names do not appear in the development environment. But it is not a free pass. We describe it precisely in the data path so that your data protection team can assess it. More in the article Data masking for AI.
An inventory your data protection team needs
Before an AI tool runs with real data, there should be an overview that answers the following questions:
- Which databases and files are read?
- Which content goes into requests to the model, and in what form?
- What is logged, where, and for how long?
- Who has access for support purposes?
- Where is the data processed, and which subcontractors are involved?
- How is data deleted?
Onagero provides this overview for every pilot before it starts. The assessment is carried out by those responsible for data protection at your company, with legal advice where appropriate.
What you should avoid
- Letting employees freely copy whatever they are working on into public chat services.
- Tools that evaluate the performance or behaviour of individual employees, without works council involvement and an impact assessment. See AI and the works council.
- Blanket statements such as “GDPR-compliant” without a description of what exactly goes where.