The GDPR governs the processing of personal data, including when it is entered into an AI tool. It requires a legal basis, a clear purpose, data minimization, and safeguards for transfers or subcontracting. The data controller remains accountable.
Example
Pasting a list of employees with their salaries into a consumer chatbot is a processing of personal data that must be justified.