Data security in an AI project comes down to a short list of controls applied before the first prompt is sent: know exactly which data the system touches, send the model as little of it as possible, process it in the EU, switch off retention and training at the provider, and make sure the AI can never see or do more than the person it acts for. Add logging an auditor can follow, hard limits on what an agent’s tools can do, a data protection impact assessment where GDPR calls for one, and a clear view of which EU AI Act obligations apply and when. None of this needs exotic cryptography, just good defaults.
Below are those defaults as we apply them on client builds, with the EU AI Act dates as amended in 2026.
Start with a data map, not a model
Before choosing a model or vendor, write down every place data enters the system, where it goes next, who or what can read it and how long it stays there. For a typical assistant or document pipeline that means the source systems, prompt assembly, the model provider, any vector index or cache, the logs, and wherever outputs are written back.
For each flow, record the categories of personal data, whether any is special category data under Article 9 of the GDPR, the lawful basis and the retention period. This feeds your record of processing under Article 30 and drives every later decision: which data must stay in the EU, which fields can be stripped before they reach a model, and which logs need short retention. Our AI readiness audit covers data access, permissions and observability as part of the same review.
Collect less: minimisation and pseudonymisation
Article 5(1)(c) of the GDPR limits personal data to what is necessary for the purpose. For AI systems this is also good engineering, because data the model never receives cannot leak through a prompt, a log or a provider incident.
Build prompts from specific fields rather than whole records. An assistant drafting replies to supplier queries needs the order number, delivery status and query text, not the supplier’s bank details. Where a task refers to people without needing to identify them, replace names and identifiers with tokens before the model call and swap them back afterwards. Pseudonymised data is still personal data under the GDPR, so this reduces risk rather than removing obligations. Apply the same thinking to retrieval: index only the documents the use case needs, and keep folders holding special category data out unless there is a documented reason.
EU hosting and data residency
Our default is to process personal data in the EU, or in the UK for UK clients who prefer it. That covers the model endpoint, vector store, application database, backups and logs. It avoids relying on transfer mechanisms under Chapter V of the GDPR.
This is achievable with mainstream models. Azure OpenAI and Google Vertex AI offer EU regional processing, Anthropic’s models are available in EU regions through cloud platforms such as AWS Bedrock and Vertex AI, and OpenAI offers EU data residency for eligible API customers. Open-weight models can be self-hosted on EU infrastructure where the data justifies it. US providers certified under the EU-US Data Privacy Framework can lawfully be used under the Commission’s July 2023 adequacy decision, but EU processing removes a dependency on a framework that has already faced legal challenge.
Retention, training and the provider contract
The major providers’ business API terms do not use customer inputs for training by default, but they typically retain prompts and outputs for a limited period for abuse monitoring. Our default is a zero-retention configuration wherever the provider offers one. OpenAI, Anthropic, Microsoft and Google all have zero or reduced data retention options for enterprise API use, generally subject to eligibility and approval.
Two caveats. Features that store state by design, such as uploaded files, saved threads or batch jobs, may fall outside a zero-retention arrangement, so the application should avoid or account for them. And zero retention at the provider does nothing about your own logs, caches and vector stores, which need their own retention rules.
Under Article 28 of the GDPR, a provider processing personal data on your behalf is a processor, so you need a data processing agreement. Check the sub-processor list and how you will be told about changes.
Access control: the model sees what the user may see
An AI assistant connected to company systems must not become a way around existing permissions. Retrieve data with the permissions of the person the system acts for, not a shared administrator account. If a user cannot open a document in SharePoint, the assistant should not be able to quote it to them. Filter retrieval results by the user’s rights before they reach the prompt, rather than asking the model to withhold what it has already seen. Keep service accounts narrowly scoped, hold secrets in a vault, and limit who can change prompt templates and tool definitions, because a system prompt change can alter behaviour as much as a code change.
Logging and audit trails
Log enough to reconstruct what happened: which user triggered the system, what was retrieved, which model and prompt version ran, what came back, which tools were called with which arguments, and who approved any action. Logs also collect the data you minimised elsewhere, so redact where the full value is not needed, restrict access and set a retention period. For systems that act in other systems, make logs tamper-evident. Our piece on compliance reporting automation goes further into audit trails.
Prompt injection and tool permissions
Prompt injection is the top entry in the OWASP Top 10 for Large Language Model Applications, and no model reliably resists it. Any system that reads untrusted content, such as inbound email, uploaded documents or web pages, must assume that content may contain instructions designed to hijack it. The risk becomes serious when the same system can take actions. The controls we apply are architectural:
- Give each agent only the tools its task needs, with the narrowest scope, preferring read-only tools.
- Require human approval for actions that send data outside the organisation, move money, delete records or change permissions.
- Validate tool arguments in code: allowed recipients, record types and value limits.
- Block channels that could carry data out, such as arbitrary URLs or images from untrusted sources.
- Treat model output as untrusted input to the next system.
Keeping people on consequential decisions is covered in human-in-the-loop action tags for AI agents.
The data protection impact assessment
Article 35 of the GDPR requires a DPIA where processing is likely to result in a high risk to individuals, and specifically mentions new technologies. Ireland’s Data Protection Commission and the UK’s ICO both publish guidance on when one is required. AI systems that profile people, support decisions about them, process special category data or monitor employees will often need one. Do it early, while the design can still change; the data map, access model and provider configuration above supply most of the material. If the AI makes decisions with legal or similarly significant effects without meaningful human involvement, Article 22 also applies.
EU AI Act obligations by date
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. Its timeline was amended in July 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which postponed the high-risk deadlines. As things stand:
- 2 February 2025: prohibited practices under Article 5 apply, along with the AI literacy provisions in Article 4.
- 2 August 2025: obligations for providers of general-purpose AI models, plus the governance and penalty provisions.
- 2 August 2026: the Article 50 transparency obligations. A chatbot or assistant that talks to the public must tell people they are dealing with an AI system unless that is obvious, and AI-generated content must be marked as Article 50 describes.
- 2 December 2026: end of the grace period for machine-readable marking by systems already on the market before 2 August 2026.
- 2 December 2027: obligations for high-risk systems in Annex III, such as AI used in recruitment and employee management, creditworthiness assessment, and pricing for life and health insurance.
- 2 August 2028: obligations for high-risk AI embedded in products covered by the EU legislation listed in Annex I.
Most business uses, such as internal assistants, document processing and drafting tools, are not high-risk under the Act, though the GDPR still applies and the transparency rules may. If a use case touches an Annex III area, classify it formally now: the deadline moved, but documentation, risk management and human oversight take time to build.
The default control set
These are the controls we put in place on every production AI build unless there is a documented reason not to:
- A data map and record of processing for every flow.
- Field-level minimisation, with pseudonymisation where identities are not needed.
- EU hosting for models, data stores, backups and logs.
- Zero-retention configuration at the model provider, no training on client data, and a signed DPA.
- Retrieval filtered by the user’s own permissions, and narrowly scoped service accounts.
- Tamper-evident logs with redaction and a defined retention period.
- Least-privilege tools, argument validation and human approval for consequential actions.
- A DPIA where GDPR requires one, and an AI Act classification for each use case.
They are cheapest to build once into a shared platform that every workflow inherits, as we argue in how to build software systems that compound over time.
How D3X Solutions LABS can help
D3X Solutions LABS is an AI engineering studio in Ireland building AI agents, automation and LLM integrations for businesses in the EU, UK and Ireland. Security and privacy are part of the build, not a review at the end. We map the data flows of the use case, agree where data will be processed, and build the controls into code: EU-hosted models, zero-retention provider settings, permission-aware retrieval, scoped tools, approval steps and audit logs.
We also review existing AI systems against the same control set and rank the gaps by risk, and we can supply the technical description your data protection lead needs for a DPIA or an AI Act classification. If you want a second pair of eyes on an AI project before it goes live, book a free 30-minute call.
Frequently Asked Questions
Is it GDPR-compliant to send personal data to an LLM API?
It can be, provided you have a lawful basis, a data processing agreement with the provider, a clear retention position and safeguards for any transfer outside the EU. Minimising the data sent, processing it in the EU and using zero retention make the position much easier to defend.
What does zero data retention mean for AI APIs?
The provider does not store your prompts and outputs after responding, including for abuse monitoring. Major providers offer it to eligible enterprise API customers, usually by agreement. Stateful features such as file uploads may not be covered, and your own logs need separate rules.
Do we need a DPIA for an AI project?
Article 35 of the GDPR requires one where processing is likely to result in a high risk to individuals. AI that profiles people, supports decisions about them, processes special category data or monitors staff often meets that threshold. If in doubt, do one: it also documents your design choices.
When do the EU AI Act high-risk rules apply?
After the 2026 Digital Omnibus amendment, Annex III high-risk obligations apply from 2 December 2027 and Annex I obligations from 2 August 2028. Prohibited practices have applied since 2 February 2025 and Article 50 transparency obligations since 2 August 2026.
How do you protect an AI agent from prompt injection?
Do not rely on the model to ignore malicious instructions; limit what an injected instruction could achieve. Give agents few, narrowly scoped tools, validate tool arguments in code, block channels that could carry data out, and require human approval for sensitive actions.
Want this working in your business?
D3X Solutions LABS builds AI agents and automation that pay back fast. Set up a free 30-minute call and we will map your first win together.
Get in touch
