Generative AI in the GDPR processing register: a guide for DPOs

Does generative AI belong in the processing register?

Whenever personal data goes in, yes. The register lists the processing an organization carries out, and pasting a client’s letter, an employee’s appraisal or a resident’s file into ChatGPT, Copilot or Le Chat is processing: the data is sent to a provider, processed by it and kept for a while. The CNIL, France’s data protection authority, makes the point in its Q&A on generative AI: it is the user organization that bears legal responsibility if its staff misuse the tool.

Article 30(5) exempts businesses and organizations with fewer than 250 employees, but the exemption falls away if the processing is likely to pose a risk to people’s rights, is not occasional, or involves special-category or criminal data. The CNIL stresses that the derogation is limited to very particular cases and advises recording the processing when in doubt. A tool the team uses every day is not occasional: a ten-person firm has to document it too.

The register is kept by the controller, or by the processor for what it handles on behalf of clients; the DPO can be put in charge of it. Its form is free, on paper or electronic, as long as it is in writing. The CNIL offers a simplified spreadsheet template for small organizations (SMEs, associations, small local authorities).

A separate entry, or a line in existing ones?

The GDPR thinks in processing activities, that is, by purpose. Two approaches are defensible:

• A dedicated entry (“Drafting and analysis support using generative AI”) when AI is used across the organization, by every team, with one approved tool. It is easier to read and to update when the plan or the provider changes.
• Updating existing entries (client files, HR, citizen services) when AI is just one means serving a purpose already recorded. You then add the provider to the recipients, any transfers and the AI-specific measures in each one.

In practice, many DPOs combine both: a cross-cutting entry for the tool, and a cross-reference from the business entries that use it. What matters is that an auditor can trace, for every piece of data sent to the AI, who sends it, why and under which safeguards.

What goes into the entry? The worksheet

Article 30(1) sets seven fields for the controller. Here is how to fill them in for generative AI use, with an example and the supporting document. The examples are illustrative: adapt them to your plan and your uses.

Three columns Article 30 does not require but a DPO should add: the legal basis of the processing, the approved tool and plan (a personal account is not an approved plan), and the DPIA decision, carried out or ruled out, with its justification. On choosing the plan and the contract, see ChatGPT and GDPR: can you put client data into it? and Microsoft 365 Copilot and professional secrecy.

On retention, do not copy a generic value: it varies by plan and changes often. At OpenAI, for example, a deleted conversation is scheduled for erasure within 30 days, unless security or legal obligations apply, and a temporary chat may be kept for up to 30 days for safety purposes. Date the check in the entry.

What do the CNIL and its fact sheets say about AI?

A clarification first: the CNIL’s AI fact sheets mostly concern the development of AI systems (building training datasets, legal basis, annotation, development security). They help an organization that trains or fine-tunes a model; they are not written for one that uses an off-the-shelf assistant.

For use, the reference is the CNIL’s Q&A on using a generative AI system (July 18, 2024). What a DPO can take from it for the register and internal policy:

• involve the DPO and, where relevant, carry out an impact assessment;
• check the provider’s GDPR compliance and, if the infrastructure is external, frame the relationship with a processing agreement;
• prefer on-premises solutions when client or staff data is involved;
• set out permitted and prohibited uses in an internal policy, and train users;
• with a consumer service, never share personal data.

For impact assessments, the CNIL’s AI fact sheet no. 5 is still useful, even though it was written for development: it states that the user of an AI system, as controller, remains responsible for its own DPIA where one is needed. A policy template that puts this advice into practice: AI use policy for a firm.

Minimization and pseudonymization: which measures to record?

Three articles work together. Article 5 requires data limited to what is necessary. Article 25 (data protection by design and by default) calls for appropriate measures “such as pseudonymisation” to implement that principle. Article 32 lists first, among security measures, “the pseudonymisation and encryption of personal data.” To summarize a contract or reword a letter, the AI needs no names: sending them anyway is hard to justify.

Pseudonymization only counts as a measure if it happens before sending and the key stays separate. Article 4(5) requires the additional information that allows re-identification to be kept separately and protected; the EDPB adds that lookup tables are themselves personal data and must be protected against unauthorized access (Guidelines 01/2025, paragraph 93). Asking the AI to pseudonymize the text itself therefore does not meet that condition: see can you ask an AI to anonymize a document?

In the measures field, write down the rule and how it is checked: “No document containing personal data is sent to the AI without prior pseudonymization on the computer and review by the user; the mapping table stays encrypted on the computer.” Also note that pseudonymized data remains personal data (Recital 26): the entry is still needed, but the risk to document is much lower. The difference between the techniques: pseudonymization or redaction.

Do you need a DPIA?

Article 35 requires one when processing, “in particular using new technologies,” is likely to result in a high risk to people’s rights and freedoms. Three cases always qualify: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, with legal or similarly significant effects; large-scale processing of special-category or criminal data; and large-scale systematic monitoring of a publicly accessible area.

Beyond those cases, the CNIL applies the nine criteria of the European guidelines: processing that meets at least two is presumed to need a DPIA. For AI, the most common are sensitive or highly personal data, vulnerable people, data matching and innovative use; in its AI fact sheet no. 5, the CNIL counts generative AI systems trained on large amounts of data among techniques that are still new. Since 2018 the CNIL has also published a list of fourteen types of processing for which a DPIA is mandatory.

These pointers do not replace a case-by-case analysis. If you carry out a DPIA, Article 35(7) sets its minimum content: a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks, and the planned measures. Prior pseudonymization then sits among the measures, and the log that proves it among the means of demonstrating compliance. For the sectors concerned: HR, healthcare, public sector.

What evidence should you keep of AI use?

The register describes what is planned; you still need to show it is applied. The documents a DPO gathers, alongside the entry:

• The contract with the provider (DPA, Article 28), with the list of sub-processors and transfer safeguards.
• The plan configuration: business accounts, training turned off, retention period, date of the check.
• The use policy and evidence of staff training (Article 39 tasks the DPO with awareness-raising and training).
• A record of pseudonymization: what was removed, when, by whom, and what was sent. This is where a local tool can help, provided its own record contains no data.

For legal departments and DPOs: anonymization software for in-house counsel and DPOs.

What does the AnonymFiles audit log contain?

AnonymFiles keeps three separate records, all on the computer. Exactly what they contain:

The audit log is encrypted entry by entry, append-only, and each entry is linked to the previous one by its SHA-256 fingerprint. The Audit log screen verifies the chain (“Log intact: N entries”) and exports it as CSV or JSON, to attach to a DPIA or show during an inspection.

Its limits, which belong in your documentation too:

• it proves that pseudonymization was performed and approved, not that it was sufficient: quality depends on the review;
• deleting the most recent entries is only visible by comparing two successive exports of the log: export it regularly;
• it only sees what goes through the app: a colleague who pastes a document straight into a chatbot leaves no trace there. The policy and training cover that case.

For the app’s network behavior (no account, no telemetry, license checked offline): security. Per-seat pricing: pricing.