---
title: "AI automation and GDPR: a checklist for Hungarian companies"
description: "Seven things to settle before an AI system touches customer data: lawful basis, DPAs, data minimisation, residency, retention, disclosure and records."
canonical: https://aiautomatizaciocegeknek.hu/en/blog/ai-automation-gdpr-checklist
language: en
publisher: AI Automatizáció
published: 2026-09-19
updated: 2026-09-19
---

# AI automation and GDPR: a checklist for Hungarian companies

Seven things to settle before an AI system touches customer data: lawful basis, DPAs, data minimisation, residency, retention, disclosure and records.

## Key takeaways

- The GDPR does not prohibit AI automation; it shapes how it is built.
- Sign a DPA with every provider in the chain and send models only the fields they need.
- Tell people when they interact with an AI. The EU AI Act requires it.

## The seven-point checklist

Work through these in order during scoping. Each takes hours, not weeks.

1. Lawful basis: name it for each data flow, usually contract performance or legitimate interest.
2. Data processing agreements: one with every provider that sees personal data, including the model API.
3. Data minimisation: send the model the fields the task needs, not the whole record.
4. Residency: choose EU regions where offered; otherwise rely on standard contractual clauses and document it.
5. Retention: define how long logs and transcripts are kept, then delete automatically.
6. Disclosure: tell people at the start of a call or chat that they are speaking with an AI.
7. Records: add each AI processing activity to your records of processing and, for higher-risk uses, run a DPIA.

## Where companies usually slip

Two places: using a consumer AI account instead of a business API with a DPA, and keeping call recordings indefinitely 'just in case'. Both are easy to fix before launch and hard to explain afterwards.

## FAQ

**Do I need a DPIA for a voice agent?**

Often yes if it records calls or processes health, financial or other sensitive data at scale. For a booking agent at a hair salon, usually no, but documenting the assessment is still good practice.