Automating Processes in Line with the GDPR
· by Panayot Dimkov
Almost any administrative process you automate touches personal data. An invoice carries a contact's name; an employee onboarding carries half a person's life; a flow that sorts email reads what identifiable customers write. The moment a bot or an AI model passes through, there is processing of personal data and the GDPR applies.
This article walks through the points where an automation goes wrong, what to demand from your vendor and what to check before putting a flow into production. If cost is what you are after, we cover it in how much it costs to automate a process with AI.
1The five GDPR failures when automating processes
These are not theoretical. They are the ones that come up again and again when an already built flow is reviewed.
2What to update when you automate
There are three documents almost nobody touches when building a flow, and they stop reflecting reality the moment it goes live.
| Document | What changes when you automate |
|---|---|
| Record of processing activities | New recipients appear (the tools), sometimes new international transfers and, frequently, different retention periods |
| Information given to data subjects | If there are Article 22 automated decisions, including profiling, they must be disclosed, along with the logic involved and the envisaged consequences |
| Data protection impact assessment | It may become mandatory. The Spanish Data Protection Agency (AEPD) considers it necessary in most cases that meet two or more criteria on its list, including profiling, automated decisions, large-scale data, combining databases with different purposes or innovative use of technology |
The impact assessment frightens people more than it should. It is not a filing with the authority: it is an internal analysis, and on a small project it runs to a few pages. You only need to consult the supervisory authority if the risk remains high once the measures are in place. What goes wrong is not having considered it when it was due.
3The AI Act: what already applies and what does not yet
The European AI Act now sits alongside the GDPR, and the two should not be mixed up: one protects personal data, the other regulates AI systems by their level of risk.
4What to demand from your vendor
These are the five things to have in writing before connecting a tool to real data.
- A processor agreement with the Article 28 clauses, not just terms of service accepted with a click.
- The list of sub-processors and prior notice when it changes. Nearly every platform leans on third parties; the problem is not knowing which.
- Where processing takes place and, if it leaves the European Economic Area, what the transfer relies on (an adequacy decision or standard contractual clauses, for example).
- A commitment not to train on your data, if you use an AI service. Many vendors offer this, sometimes by default on business plans and sometimes as an option you have to switch on; either way, get it in writing.
- Retention and deletion periods, including the flow's execution logs, which usually contain data and stay there forever.
5How to design a GDPR-compliant flow
Data protection by design is not a textbook phrase: it is a set of concrete decisions taken while building the flow.
The official reference in Spain is the Spanish Data Protection Agency, which publishes specific guidance on artificial intelligence and impact assessments. This article is informative and does not replace legal advice.
Frequently asked questions
Can I use an AI service with customers' personal data?
Yes, provided there is a lawful basis, a processor agreement with the vendor, the required information is given to data subjects and you know where the data is processed. What you cannot do is paste customer information into a public tool with no contract and no idea what it does with it.
Do I need an impact assessment to automate a process?
It depends on the processing, not on the technology. It is required when there is likely to be a high risk to people's rights, which usually happens when several factors combine, such as large-scale processing, systematic evaluation of personal aspects or new technologies in sensitive contexts. Automating invoice registration usually does not require one; automating candidate screening almost always does.
What does the GDPR say about automated decisions?
Article 22 restricts decisions based solely on automated processing that produce legal effects or similarly significantly affect a person, and grants the right to obtain human intervention, to express a point of view and to contest the decision. The key word is "solely": if a person reviews with judgement and can change the outcome, the situation is different.
Does the AI Act affect me if I only automate administrative tasks?
Since 2 August 2026 most of the regulation applies, including transparency obligations on interaction with AI systems and labelling of certain generated content. The obligations for Annex III high-risk systems were postponed to 2 December 2027, and most administrative automations do not fall into that category.
What about the data left in the flow's logs?
It is personal data like any other and it is usually the project's blind spot. Execution logs often store the content of what was processed and nobody gives them an expiry date. Setting a retention period and automatic deletion is one of the cheapest and most effective measures available.
In short
The GDPR is not an obstacle to automating; it is a fairly reasonable design guide. Moving only the fields you need, knowing where processing happens, having the contract signed and leaving a person on the decisions that genuinely matter are measures that also make the flow cleaner and easier to maintain.
What is a problem is discovering all this at the end. Raising these questions at design time costs a few hours; resolving them with the flow in production means rebuilding it. That is how we approach AI process automation.
Want to automate without legal surprises?
Tell us which process you have in mind and what data it works with. We design the flow with minimisation, processing location and human involvement in mind from the first sketch.
Request a process analysisNexum Blog
Related articles
9 Oct 2026
Mandatory B2B E-Invoicing in Spain: What to Do
Mandatory B2B e-invoicing in Spain now has its regulation: expected dates, how it differs from Verifactu and how to prepare while automating.
14 Aug 2026
Modbus vs Profinet vs OPC UA: which one to use
Modbus, Profinet and OPC UA compared: speed, determinism, security and cost. Find out which protocol to use at each layer of your plant.
8 Apr 2026
Predictive maintenance in automated plants: what is it and how to implement it?
Discover what is predictive maintenance in automated plants, how to implement it step by step and what technologies you need to reduce downtime and costs.