GDPR AI compliance with Audact

How Audact handles GDPR

GDPR Article 22: automated decision-making and AI

Article 22 gives every data subject the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects or similarly significantly affects them. For AI deployers this is the most consequential provision in GDPR: an AI system that declines a loan, rejects a job applicant, triggers a fraud block or schedules a disciplinary hearing without meaningful human review falls squarely within Article 22.

Lawful routes exist: explicit consent, necessity for a contract, or authorisation under Union/Member-State law with adequate safeguards. In all cases the controller must provide meaningful information about the logic involved, the significance of the processing, and give the subject the right to obtain human intervention, express a point of view and contest the decision. The European Court of Justice confirmed in SCHUFA (C-634/21, 2023) that probability scoring used by third parties to drive a decision is itself "automated decision-making" — broadening Article 22 for AI vendors.

How AI systems trigger GDPR data protection obligations

Training, fine-tuning and inference on personal data are each distinct processing activities under Article 4(2), and each requires its own lawful basis under Article 6. Voice agents, chatbots and agentic workflows routinely ingest names, phone numbers, voice biometrics and content revealing health, beliefs or sexuality — which can escalate processing to special-category data under Article 9, requiring a stronger basis such as explicit consent or substantial public interest.

A Data Protection Impact Assessment (Article 35) is effectively mandatory for most customer-facing AI deployments: they combine systematic monitoring, new technology and often vulnerable data subjects. Controllers must also satisfy the transparency duties of Articles 13–14 at the point of data collection — a duty that AI voice agents frequently fail to meet because the disclosure happens too late in the conversation.

Cross-border data transfers under GDPR for AI providers

Chapter V of GDPR restricts transfers of personal data outside the EEA. Following Schrems II, controllers must conduct a Transfer Impact Assessment whenever using Standard Contractual Clauses, and the EU–US Data Privacy Framework currently provides the only adequacy bridge to the United States. Many popular AI providers (OpenAI, Anthropic, Google) process EU data on US-based infrastructure under DPF or SCCs, which shifts the due-diligence burden onto the customer.

Audact solves this by operating exclusively inside the EU: inference traffic, metadata, keys and backups remain within AWS Frankfurt and Amsterdam. No Chapter V transfer ever occurs, eliminating TIA overhead and removing dependence on the DPF's ongoing political stability.

Data processing roles

Audact operates as a data processor. The customer remains the data controller at all times. Audact processes data solely on behalf of and under the instructions of the controller.

Data Processing Agreement

Our standard DPA is available at /legal/dpa. Enterprise customers can request a custom DPA.

Frequently asked questions

Compare EU AI compliance laws

Related compliance resources

• EU AI Act Article 50 compliance overview
• Digital Services Act compliance for AI
• Audact compliance platform pricing