Germany’s data protection authorities have published guidance for organizations selecting and using AI tools. It is a decision aid under applicable data protection law, not a stand-alone permission to upload employee or customer information.
Know the origin and purpose
The DSK guidance of May 6, 2024 primarily addresses application and selection of large language model services. Later DSK material addresses specific technical issues, including RAG and security. Version matters.
Determine whether personal data enters the workflow
Prompts, retrieved documents, chat logs, annotations and generated answers can contain identifiable information. Map who is responsible for purposes, who processes the data and the applicable GDPR/other-law basis.
Review input and output channels
A no-training setting does not necessarily stop logs, monitoring or retention. Distinguish model training from context retrieval and service operation. Account for accidental disclosure through prompts and output rendering.
Worker and sensitive data need extra review
An HR assistant using performance records presents different risks from a public product FAQ. Consider labor, workplace, secrecy and special-category rules separately. A vendor-hosted workflow may also trigger international transfer analysis.
Practical supplier diligence
Ask for data flow charts, deletion handling, subprocessor lists, technical security controls and country-level storage/access details. Demonstrate that contractual promises match configured behavior. Run access-control tests on your own documents.
Interpretation limit
DSK orientation is official supervisory guidance, not a substitute for statutes, judicial decisions or authority-specific enforcement facts. Document application to the actual deployment and recheck newer guidance before publication.
Sources & Further Reading
- German DSK AI and data protection guidance — German Conference of Data Protection Authorities.
- German DSK official guidance index — German Conference of Data Protection Authorities.
Jurisdiction/scope: Germany / EU GDPR. This is educational information and does not constitute legal or other professional advice. No hands-on product test is claimed.