The GDPR, included in every AI project

No. The GDPR governs the processing of personal data, whatever the tool: a well-designed AI agent complies with it like any other software. With us, every project that involves personal data (yours, your employees’ or your clients’) is designed from the outset to comply with it, at no extra cost. Always included:

• processing only the data that is necessary, with a legal basis for each processing operation;
• defined retention periods, and the rights of the people concerned respected;
• providers bound by contract, including the AI model supplier;
• audit trails, and an impact assessment when one is required.

Yes. When we process personal data on your behalf, we are your processor within the meaning of Article 28 of the GDPR: a personal data processing agreement is signed with the contract, of which it forms part. It names the providers that process this data, including as soon as a third-party AI model is involved, and we remain responsible for them towards you.

Only when the processing presents a high risk for people: sensitive data, surveillance, large-scale automated decisions. The impact assessment then examines these risks and the measures to reduce them. The question is raised during scoping; whether one is required is for your data protection officer or your lawyer to say. When it is, it is part of the project and is not priced separately.

Your company keeps the obligations of the controller: when Synergetik processes personal data for you, it acts as your processor (Article 28 of the GDPR). It is up to you to:

• decide why and how this data is processed, and tell us in writing;
• inform your customers and employees, including when they interact with an AI;
• have legal questions settled by your data protection officer or lawyer;
• approve the results produced.

On our side, each processing operation is designed from the start to comply with the GDPR, at no extra cost: only the data that is needed, an identified legal basis, defined retention periods, audit trails, providers bound by contract.

In the event of a personal data breach, Synergetik tells you without delay, with the information you need to report it: this is a commitment in the data processing agreement, signed with the contract. Reporting the breach falls to your company, as the controller; we help you do so, with the information we hold.

Everything is designed to limit this risk and to understand quickly what happened:

• only the people who need your data have access to it, and they are bound by confidentiality;
• each agent accesses only the data its work requires, with access you can revoke at any time;
• a log keeps track of what each agent does.

Your company answers these requests, as the controller, and Synergetik helps it do so: this is provided for in the data processing agreement signed with the contract. Respect for individuals’ rights (access, rectification, erasure) is designed in from the start, at no extra cost:

• a request that reaches us directly is passed on to you without delay;
• we give you the information needed to answer it;
• the documentation delivered with each agent says who has access to what and where the data flows.

Your personal data is kept for the period set for each processing operation, which you know before you sign; at the end of the contract, Synergetik returns it to you, then deletes it. Retention periods are defined for each processing of personal data, audit trails included, and the “Where your data goes” page attached to your proposal or your contract sets them out.

Returning and then deleting your data at the end of the contract is a commitment in the data processing agreement, signed with the contract.