GDPR

GDPR considers not only where personal data is stored, but why it is processed and who can access it. Connecting a document to an AI assistant can place that data in a new context during retrieval and answer generation.

A company does not need to be located in the EU for every analysis to disappear. Data about people in the EU or processes serving EU customers can make the scope question relevant, alongside contracts and technical architecture.

A sound starting point is to define the questions an assistant must answer. Connect only the folders needed for those questions; do not make old candidate files, unnecessary identifiers, or an entire mailbox part of the default scope.

KobiGPT’s company, department, and role boundaries support access design. You still need to document user assignments, file ownership, and data flows to external model providers.

Citations make the text behind an answer easier to inspect and expose an incorrectly selected document. They do not replace processes for data-subject rights, erasure requests, or retention policies.

A GDPR review does not end with a technical checklist. Purpose, legal basis, processor agreements, transfer mechanisms, and breach procedures should be approved for the actual use case.

A useful way to evaluate gdpr is to follow one real question from the source document to the final answer. Record which file was selected, what context reached the model, and what a reviewer would need to verify. This turns a definition into an operational check and makes the result comparable across teams.

The same check should include ownership and change management. Decide who updates the relevant documents, how an outdated result is reported, and which access boundary applies. KobiGPT can provide the assistant and the cited document context, but the organisation still owns the source material, permissions, and the decision made from the answer.