According to the Bavarian State Office for Statistics (2026), 29 % of companies in Bavaria with at least ten employees used an AI technology in 2025 – up from 23 % the year before. The trend is clear. And yet many businesses are hesitant, because the word data protection instantly makes their heads spin. It doesn't have to be that way. The GDPR is not a ban on AI. It's a playing field with clear lines – and once you know them, you can move freely within them.
According to a Bitkom study (2026), 68 % of companies in the DACH region see data protection as a critical obstacle to using AI. Most of them not because they are doing anything wrong – but because nobody has explained to them what is actually allowed.
The key term is: personal data. As soon as an AI tool processes data that could identify a natural person – name, email, phone number, IP address, location – the GDPR applies. That sounds like a lot, but it can be handled cleanly with a few ground rules.
Rule 1 – Processing only with a legal basis. Before you feed customer data into an AI tool, you need either consent, a contract, or a legitimate interest as the basis. Without that, nothing goes.
Rule 2 – Sign a Data Processing Agreement (DPA). As soon as an external provider processes your data – which includes every cloud-based AI service – you need a DPA. Providers such as OpenAI or Anthropic make these available. Without a DPA, use of the service is simply not permitted.
Rule 3 – Take data minimisation seriously. AI tools don't need real names or actual customer data for most tasks. Anonymise wherever possible – a chatbot that drafts quote texts doesn't need to know that the customer is called Max Mustermann from Holzkirchen.
Rule 4 – Check server location. Data may generally only be transferred to countries with an adequate level of data protection. US-based servers are no longer an automatic disqualifier, but the DPA must include the EU Standard Contractual Clauses. If you want to play it safe, go with European servers or run models locally.
Rule 5 – From August 2026: label chatbots. Mandatory from August 2026 under Article 50 of the EU AI Act: users must be able to tell that they are communicating with an AI system. If you are building a chatbot now, you should factor this in from the start – retrofitting it later is much more effort.
Two tools we recommend again and again in our projects when it comes to using AI in a way that meets GDPR requirements:
Ollama is an open-source platform that lets you run large language models locally on your own servers – without a single byte of data leaving your network. That is the crucial difference from cloud-based solutions such as the OpenAI API: no third-party provider, no DPA hassle, no data transfer to the US. For businesses that handle sensitive customer or patient data – tax offices, medical practices, tradespeople with tender documents – this is often the safest choice.
n8n is an automation tool that can be self-hosted, keeping full control of the data in your hands. While Zapier or Make run your workflows and the data they contain on third-party servers, you can run n8n on your own infrastructure. For connecting AI models with existing systems – CRM, email, accounting – this is the most privacy-friendly option. You can find out more about what is possible with this kind of automation in our automation projects.
A trade business from Penzberg used a combination of Ollama and n8n to fully automate its quote creation – without transferring a single piece of customer data to an external cloud. The result: around 4 hours of office work saved per week, with a demonstrably GDPR-compliant process. We show exactly what that looks like in our project on AI-assisted quote creation in the trades.
Here is the uncomfortable truth that goes unspoken in many AI consultations: Local models like Ollama are capable, but not all-powerful. The open-source models currently available for local use do not yet reach the level of GPT-4o or Claude 3.5 Sonnet in terms of language quality and depth of reasoning. Anyone wanting to summarise complex legal texts or automate multilingual customer support will often run into quality issues with a local model.
That's no reason to throw in the towel – but it is an honest consideration: for simple, repetitive tasks like text templates, internal FAQs or structured data entry, local models are more than adequate. For anything requiring higher language quality, the data protection concept needs to be correspondingly more elaborate.
Also worth noting: an AI chatbot quickly hits its limits as soon as customer enquiries become legally sensitive. Liability questions, complaints or complex contract situations should still be handled by humans – this needs to be clearly defined in the concept.
What we observe in practice: In 8 out of 10 of our projects in the region, the first bottleneck wasn't the technology – it was the lack of internal clarity about which data is actually involved in which process. If you don't know what you're processing, you can't build a solid data protection concept. That's the homework that needs to be done before the first tool is deployed.
And one more thing we'll say straight out: Most data protection concerns around AI are not wrong – they're just applied to the wrong problems. A business that bans an employee from using ChatGPT for meeting notes, while at the same time sending customer addresses by unencrypted email, has its priorities back to front. Data protection with AI is solvable. It takes structure, not panic.
If you want to know what a GDPR-compliant start with AI could look like for your business in Upper Bavaria – without buzzword bingo and without a six-month consulting project – book a free initial call with us now. We are based in Bad Tölz-Wolfratshausen and know the requirements of mid-sized businesses in the region from our own experience.
We analyze your processes, identify automation potential and show you which digital systems really make sense.
