{"id":6171,"date":"2026-10-09T18:16:44","date_gmt":"2026-10-09T16:16:44","guid":{"rendered":"https:\/\/mforz.com\/?page_id=6171"},"modified":"2026-10-09T18:16:44","modified_gmt":"2026-10-09T16:16:44","slug":"avg-en-ai-in-bedrijfsprocessen","status":"publish","type":"page","link":"https:\/\/mforz.com\/en\/avg-en-ai-in-bedrijfsprocessen\/","title":{"rendered":"How do you set up AI in compliance with the GDPR?"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"6171\" class=\"elementor elementor-6171 elementor-bc-flex-widget\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a6171c1 e-con-boxed e-flex e-con e-parent\" data-id=\"a6171c1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b6171d2 elementor-widget elementor-widget-spacer\" data-id=\"b6171d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c6171e3 elementor-widget elementor-widget-html\" data-id=\"c6171e3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>\n  .mf-reference,.mf-reference *{box-sizing:border-box}\n  .mf-reference{\n    --mf-primary:#2F4F6F;\n    --mf-accent:#f49000;\n    --mf-accent-hover:#A95400;\n    --mf-eyebrow:#f49000;\n    --mf-page:#F8FAFC;\n    --mf-soft:#EFF6FF;\n    --mf-white:#FFFFFF;\n    --mf-text:#0F172A;\n    --mf-muted:#475569;\n    --mf-border:#E2E8F0;\n    --mf-radius-section:20px;\n    --mf-radius-button:10px;\n    --mf-shadow:0 14px 36px rgba(15,23,42,.06);\n    margin:0;\n    padding:0;\n    background:var(--mf-page);\n    color:var(--mf-text);\n    font-family:\"DM Sans\",Arial,sans-serif;\n    line-height:1.7;\n  }\n  .mf-reference a{color:var(--mf-primary);text-decoration-color:var(--mf-accent);text-decoration-thickness:2px;text-underline-offset:3px}\n  .mf-reference a:hover{color:var(--mf-accent-hover)}\n  .mf-reference a:focus-visible{outline:3px solid rgba(244,144,0,.35);outline-offset:3px}\n  .mf-ref-shell{width:min(1100px,100%);margin:0 auto}\n  .mf-ref-hero{display:grid;grid-template-columns:minmax(0,1.2fr) minmax(280px,.8fr);gap:44px;align-items:center;padding:52px;background:var(--mf-page);border:1px solid var(--mf-border);border-radius:var(--mf-radius-section)}\n  .mf-ref-eyebrow{margin:0 0 14px;color:var(--mf-eyebrow);font-size:12px;font-weight:800;letter-spacing:.12em;text-transform:uppercase}\n  .mf-ref-hero h1{margin:0;color:var(--mf-text);font-size:clamp(38px,5vw,58px);font-weight:750;letter-spacing:-.035em;line-height:1.06}\n  .mf-ref-intro{max-width:720px;margin:22px 0 0;color:var(--mf-muted);font-size:19px;line-height:1.65}\n  .mf-ref-meta{display:flex;flex-wrap:wrap;gap:10px 18px;margin:24px 0 0;padding:0;list-style:none;color:var(--mf-muted);font-size:13px}\n  .mf-ref-meta li{margin:0}\n  .mf-ref-hero figure{margin:0}\n  .mf-ref-hero img{display:block;width:100%;height:auto;aspect-ratio:4\/3;object-fit:cover;border-radius:16px;box-shadow:var(--mf-shadow)}\n  .mf-ref-hero figcaption{margin-top:9px;color:var(--mf-muted);font-size:12px;line-height:1.45}\n  .mf-ref-layout{display:grid;grid-template-columns:260px minmax(0,1fr);gap:36px;align-items:start;margin-top:36px}\n  .mf-ref-toc{position:sticky;top:24px;padding:24px;background:var(--mf-white);border:1px solid var(--mf-border);border-radius:var(--mf-radius-section);box-shadow:var(--mf-shadow)}\n  .mf-ref-toc h2{margin:0 0 14px;color:var(--mf-primary);font-size:17px;line-height:1.3}\n  .mf-ref-toc ol{display:grid;gap:10px;margin:0;padding-left:20px}\n  .mf-ref-toc li{padding-left:3px;color:var(--mf-muted);font-size:14px;line-height:1.45}\n  .mf-ref-toc a{text-decoration:none}\n  .mf-ref-article{min-width:0}\n  .mf-ref-section{margin:0 0 28px;padding:38px 42px;background:var(--mf-white);border:1px solid var(--mf-border);border-radius:var(--mf-radius-section)}\n  .mf-ref-section--soft{background:var(--mf-soft)}\n  .mf-ref-section h2{margin:0 0 18px;color:var(--mf-primary);font-size:clamp(27px,3vw,34px);line-height:1.2}\n  .mf-ref-section h3{margin:28px 0 9px;color:var(--mf-text);font-size:19px;line-height:1.3}\n  .mf-ref-section p{margin:0 0 16px;color:var(--mf-muted);font-size:16px}\n  .mf-ref-section p:last-child{margin-bottom:0}\n  .mf-ref-answer{margin-bottom:22px!important;padding:18px 20px;border-left:4px solid var(--mf-accent);border-radius:0 14px 14px 0;background:#FFF8EE;color:var(--mf-text)!important;font-weight:650}\n  .mf-ref-checklist{display:grid;gap:12px;margin:20px 0 0;padding:0;list-style:none}\n  .mf-ref-checklist li{position:relative;padding-left:28px;color:var(--mf-muted)}\n  .mf-ref-checklist li:before{content:\"\\2713\";position:absolute;left:0;color:var(--mf-accent);font-weight:900}\n  .mf-ref-table-wrap{overflow-x:auto;margin-top:22px;border:1px solid var(--mf-border);border-radius:14px;background:var(--mf-white)}\n  .mf-ref-table{width:100%;min-width:720px;border-collapse:collapse;text-align:left}\n  .mf-ref-table caption{padding:15px 18px;background:var(--mf-primary);color:var(--mf-white);font-weight:750;text-align:left}\n  .mf-ref-table th,.mf-ref-table td{padding:15px 16px;border-bottom:1px solid var(--mf-border);vertical-align:top;font-size:14px;line-height:1.5}\n  .mf-ref-table th{background:var(--mf-page);color:var(--mf-primary);font-weight:750}\n  .mf-ref-table td{color:var(--mf-muted)}\n  .mf-ref-table tr:last-child td{border-bottom:0}\n  .mf-ref-related{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:14px}\n  .mf-ref-related a{display:block;min-height:100%;padding:20px;border:1px solid var(--mf-border);border-radius:14px;background:var(--mf-white);font-weight:750;text-decoration:none}\n  .mf-ref-related small{display:block;margin-top:7px;color:var(--mf-muted);font-size:13px;font-weight:450;line-height:1.45}\n  .mf-ref-sources{margin:0;padding-left:20px}\n  .mf-ref-sources li{margin:8px 0;color:var(--mf-muted);font-size:14px}\n  .mf-ref-cta{padding:46px 42px;border-radius:var(--mf-radius-section);background:var(--mf-primary);text-align:center}\n  .mf-ref-cta h2{margin:0;color:var(--mf-white);font-size:clamp(28px,3vw,38px);line-height:1.2}\n  .mf-ref-cta p{max-width:620px;margin:14px auto 0;color:rgba(255,255,255,.78);font-size:16px}\n  .mf-ref-button{display:inline-flex;min-height:50px;align-items:center;justify-content:center;margin-top:24px;padding:13px 26px;border-radius:var(--mf-radius-button);background:var(--mf-accent);color:var(--mf-white)!important;font-weight:800;text-decoration:none!important}\n  .mf-ref-button:hover{background:var(--mf-accent-hover);color:var(--mf-white)!important}\n  @media(max-width:900px){.mf-ref-hero,.mf-ref-layout{grid-template-columns:1fr}.mf-ref-hero figure{max-width:560px}.mf-ref-toc{position:static}.mf-ref-related{grid-template-columns:1fr}}\n  @media(max-width:640px){.mf-ref-hero,.mf-ref-section,.mf-ref-cta{padding:28px 22px}.mf-ref-intro{font-size:17px}.mf-ref-layout{gap:24px}.mf-ref-meta{display:grid;gap:6px}.mf-ref-button{width:100%}}\n<\/style>\n\n<main class=\"mf-reference\">\n  <div class=\"mf-ref-shell\">\n    <header class=\"mf-ref-hero\" aria-labelledby=\"mf-ref-title\">\n      <div>\n        <p class=\"mf-ref-eyebrow\">AI and security reference<\/p>\n        <h1 id=\"mf-ref-title\">How do you set up AI in compliance with the GDPR?<\/h1>\n        <p class=\"mf-ref-intro\">Deploying AI within your business processes is GDPR-compliant, but only if the architecture is consciously designed for it. Data processing agreements, retention periods, access control, and data classification are not afterthoughts; they are design choices. This page does not constitute legal advice. It is an overview of the points that determine in practice whether your setup is sustainable.<\/p>\n        <ul class=\"mf-ref-meta\" aria-label=\"Page information\">\n          <li><strong>Subject:<\/strong> AI, privacy and control<\/li>\n          <li><strong>Reading time:<\/strong> approximately 3 minutes<\/li>\n          <li><strong>Updated:<\/strong> October 2026<\/li>\n        <\/ul>\n      <\/div>\n      <figure>\n        <img loading=\"lazy\" src=\"https:\/\/mforz.com\/wp-content\/uploads\/2024\/10\/Database-cleaining-BW-jpg.webp\" alt=\"Databasevisualisatie bij uitleg over hoe richt je ai avg-conform in\" width=\"1200\" height=\"896\" decoding=\"async\">\n        <figcaption>Good data quality, rights, and agreements form the basis for responsible AI use.<\/figcaption>\n      <\/figure>\n    <\/header>\n\n    <div class=\"mf-ref-layout\">\n      <nav class=\"mf-ref-toc\" aria-labelledby=\"mf-ref-toc-title\">\n        <h2 id=\"mf-ref-toc-title\">On this page<\/h2>\n        <ol>\n          <li><a href=\"#welke-verwerkingen-vinden-eigenlijk-plaats\">What processing actually takes place?<\/a><\/li>\n          <li><a href=\"#wat-hoort-in-de-verwerkersovereenkomst\">What belongs in the data processing agreement?<\/a><\/li>\n          <li><a href=\"#hoe-ga-je-om-met-bewaartermijnen\">How do you handle retention periods?<\/a><\/li>\n          <li><a href=\"#wat-betekent-dataclassificatie-in-de-praktijk\">What does data classification mean in practice?<\/a><\/li>\n          <li><a href=\"#wie-is-verantwoordelijk\">Who is responsible?<\/a><\/li>\n          <li><a href=\"#waar-begin-je\">Where do you start?<\/a><\/li>\n        <\/ol>\n      <\/nav>\n\n      <article class=\"mf-ref-article\">\n        <section class=\"mf-ref-section\" id=\"welke-verwerkingen-vinden-eigenlijk-plaats\" aria-labelledby=\"welke-verwerkingen-vinden-eigenlijk-plaats-title\">\n          <h2 id=\"welke-verwerkingen-vinden-eigenlijk-plaats-title\">What processing actually takes place?<\/h2>\n          <p class=\"mf-ref-answer\">Start here, because without this answer you cannot fill in the rest.<\/p><p>As soon as an AI model processes personal data, this constitutes processing within the meaning of the GDPR. This applies to a customer name in a CRM record just as much as to an email containing a complaint.<\/p><p>Map out: which categories of personal data pass through, for what purpose, and on what legal basis. For most SME applications, this is legitimate interest or the performance of a contract, but you must be able to substantiate this.<\/p><p>What you have after that is the basis for your processing register. You must maintain that in any case.<\/p>\n        <\/section>\n\n        <section class=\"mf-ref-section mf-ref-section--soft\" id=\"wat-hoort-in-de-verwerkersovereenkomst\" aria-labelledby=\"wat-hoort-in-de-verwerkersovereenkomst-title\">\n          <h2 id=\"wat-hoort-in-de-verwerkersovereenkomst-title\">What belongs in the data processing agreement?<\/h2>\n          <p>Your AI supplier is a processor. This means a data processing agreement, which must include at a minimum: what is processed and for what purpose, how long data is retained, which sub-processors are engaged, where the processing takes place, which security measures apply, and what happens upon termination.<\/p><p>Specifically check two points that differ with AI vendors compared to standard software: whether your data is used to train models, and how long prompts and responses are retained for abuse detection, for example.<\/p>\n            <div class=\"mf-ref-table-wrap\">\n              <table class=\"mf-ref-table\">\n                <caption>Key points for How to set up GDPR-compliant AI<\/caption>\n                <thead><tr><th scope=\"col\">Ask<\/th><th scope=\"col\">Short answer<\/th><th scope=\"col\">Floor<\/th><\/tr><\/thead>\n                <tbody>\n                <tr><td>What processing actually takes place?<\/td><td>Start here, because without this answer you cannot fill in the rest.<\/td><td><a href=\"#welke-verwerkingen-vinden-eigenlijk-plaats\">Read more<\/a><\/td><\/tr>\n                <tr><td>What belongs in the data processing agreement?<\/td><td>Your AI supplier is a processor.<\/td><td><a href=\"#wat-hoort-in-de-verwerkersovereenkomst\">Read more<\/a><\/td><\/tr>\n                <tr><td>How do you handle retention periods?<\/td><td>An AI connection creates copies that you do not always see.<\/td><td><a href=\"#hoe-ga-je-om-met-bewaartermijnen\">Read more<\/a><\/td><\/tr>\n                <tr><td>What does data classification mean in practice?<\/td><td>Not all data needs to be able to pass through an AI connection.<\/td><td><a href=\"#wat-betekent-dataclassificatie-in-de-praktijk\">Read more<\/a><\/td><\/tr>\n                <tr><td>Who is responsible?<\/td><td>You, as the data controller.<\/td><td><a href=\"#wie-is-verantwoordelijk\">Read more<\/a><\/td><\/tr>\n                <\/tbody>\n              <\/table>\n            <\/div>\n        <\/section>\n\n        <section class=\"mf-ref-section\" id=\"hoe-ga-je-om-met-bewaartermijnen\" aria-labelledby=\"hoe-ga-je-om-met-bewaartermijnen-title\">\n          <h2 id=\"hoe-ga-je-om-met-bewaartermijnen-title\">How do you handle retention periods?<\/h2>\n          <p>An AI integration creates copies that you don&#039;t always see. A summary of a customer file that ends up as a note in your CRM is a new process with its own retention period.<\/p><p>Agree on where output lands and how long it remains. In practice, the simplest rule is: AI output follows the retention period of the record to which it belongs. If the customer file is cleaned up, the summary is included.<\/p><p>Also pay attention to logging. Logs that record who requested what contain personal data themselves and therefore also require a time limit.<\/p>\n        <\/section>\n\n        <section class=\"mf-ref-section mf-ref-section--soft\" id=\"wat-betekent-dataclassificatie-in-de-praktijk\" aria-labelledby=\"wat-betekent-dataclassificatie-in-de-praktijk-title\">\n          <h2 id=\"wat-betekent-dataclassificatie-in-de-praktijk-title\">What does data classification mean in practice?<\/h2>\n          <p>Not all data needs to be able to pass through an AI connection. Data classification sounds daunting, but it comes down to three categories.<\/p><p>What can always be included: standard customer and process data that your employees already have access to.<\/p><p>What is only allowed under certain conditions: more sensitive material such as contracts, financial data, and personnel information. Here, you restrict access to specific roles.<\/p><p>What may never be included: special personal data such as health data, and anything for which you have no legal basis.<\/p><p>You translate that classification into scopes in your integration. That is the moment when policy becomes technology.<\/p>\n        <\/section>\n\n        <section class=\"mf-ref-section\" id=\"wie-is-verantwoordelijk\" aria-labelledby=\"wie-is-verantwoordelijk-title\">\n          <h2 id=\"wie-is-verantwoordelijk-title\">Who is responsible?<\/h2>\n          <p>You, as the data controller. That does not change because you engage a supplier.<\/p><p>In practical terms, this means you must be able to demonstrate which choices you have made and why. A short document stating which data is accessible, to whom, on what legal basis, and for what retention period is usually sufficient for this. That is also what you produce when a customer or regulator asks for it.<\/p>\n        <\/section>\n\n        <section class=\"mf-ref-section mf-ref-section--soft\" id=\"waar-begin-je\" aria-labelledby=\"waar-begin-je-title\">\n          <h2 id=\"waar-begin-je-title\">Where do you start?<\/h2>\n          <p>First create an overview of which data can pass through the connection before configuring the connection. It works the other way around as well, but then you do the work twice.<\/p>\n        <\/section>\n\n        <section class=\"mf-ref-section\" aria-labelledby=\"bronnen-title\">\n          <h2 id=\"bronnen-title\">Sources and product information<\/h2>\n          <ul class=\"mf-ref-sources\">\n            <li><a href=\"https:\/\/www.zoho.com\/security-faq.html\" target=\"_blank\" rel=\"noopener\">Zoho Security FAQ<\/a>, official product information<\/li>\n            <li><a href=\"https:\/\/privacy.anthropic.com\/\" target=\"_blank\" rel=\"noopener\">Anthropic Privacy Center<\/a>, official product information<\/li>\n          <\/ul>\n        <\/section>\n\n        <section class=\"mf-ref-section mf-ref-section--soft\" aria-labelledby=\"gerelateerd-title\">\n          <h2 id=\"gerelateerd-title\">Related pages<\/h2>\n          <div class=\"mf-ref-related\">\n            <a href=\"https:\/\/mforz.com\/en\/is-ai-veilig-met-bedrijfsdata\/\">Is it safe to link business data to AI?<small>Read the explanation and practical points to consider.<\/small><\/a>\n            <a href=\"https:\/\/mforz.com\/en\/waar-staat-je-data-zoho-claude\/\">Where is your data stored at Zoho and Claude?<small>Read the explanation and practical points to consider.<\/small><\/a>\n            <a href=\"https:\/\/mforz.com\/en\/claude-mcp-zia-samen\/\">How do Claude, Zoho MCP, and Zia Agents work together?<small>Read the explanation and practical points to consider.<\/small><\/a>\n          <\/div>\n        <\/section>\n\n        <aside class=\"mf-ref-cta\" aria-labelledby=\"cta-title\">\n          <h2 id=\"cta-title\">Do you want to know which approach suits your organization?<\/h2>\n          <p>We examine the process, the Zoho apps used, and where AI can practically save time.<\/p>\n          <a class=\"mf-ref-button\" href=\"https:\/\/mforz.com\/en\/plan-een-gesprek\/\">Schedule a meeting<\/a>\n        <\/aside>\n      <\/article>\n    <\/div>\n  <\/div>\n<\/main>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-6171","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/pages\/6171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/comments?post=6171"}],"version-history":[{"count":1,"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/pages\/6171\/revisions"}],"predecessor-version":[{"id":6189,"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/pages\/6171\/revisions\/6189"}],"wp:attachment":[{"href":"https:\/\/mforz.com\/en\/wp-json\/wp\/v2\/media?parent=6171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}