GDPR for AI Support: What IT Teams Need to Know

“Are we even allowed to do this?” is the right first question for AI in support. The wrong answer is “No, never”.

“Are we even allowed to do this?” That is the first question management, data protection officers or the works council ask when an AI assistant is supposed to come into IT support. Rightly so: an assistant like this processes names, device data, error messages and entire chat histories. Sometimes there is more in there than you'd think: a password, a customer address, a screenshot with confidential content.

The good news: with a few clear rules, AI support can be used in compliance with data protection law. Here is what matters. Note: This is orientation, not legal advice. For your specific case, involve the data protection officer or a specialist lawyer.

What data does AI support process?

• Identity – Name, email, user account
• Device – Hostname, operating system, installed software, network data
• Content – Chat history, error messages, screenshots
• Logs – which actions were run on the device, when, approved by whom
• Incidental findings – Passwords, customer data, confidential content in screenshots

The last row is the most delicate one, and the reason why data minimization and redaction matter.

Step 1: Establish the legal basis

For IT support, two bases mainly come into question:

• Legitimate interest (Art. 6(1)(f) GDPR): working IT, quick help, relief for IT. The prerequisite is a balancing against the employees' interests.
• Performance of the employment relationship: IT support as part of the work equipment the employer provides.

Consent is usually the weaker basis in an employment relationship, because it has to be freely given.

Step 2: Data processing agreement

The AI provider processes data on behalf of the company, which requires a data processing agreement (AVV) under Article 28. It should state:

• purpose and scope of the processing,
• technical and organizational measures (encryption, access, logging),
• subprocessors, especially the operator of the AI model and the data center,
• deletion periods and return of the data,
• whether data is used to train AI models; in a business context this should be ruled out.

For IT service providers: If you run AI support for customers, you are usually a processor yourself toward the customer, and you need a contract upward (with the customer) and downward (with the AI provider).

Step 3: Where is the data processed?

Two questions: where is the data stored, and where does the AI model run? The two can differ: a provider stores in the EU but sends requests to a model in the US.

• Transfer to the US is possible, for example through the EU-US Data Privacy Framework or standard contractual clauses, with the appropriate documentation.
• Storage and model in the EU avoid the discussion from the start and are a selection criterion for many customers in the DACH region.

Step 4: Data minimization and deletion

• Collect only what is necessary: The assistant needs device data for the diagnosis, not the contents of all files.
• Redact: Passwords, tokens and similar secrets should be masked automatically before they are stored or passed to a model.
• Set deletion periods: Don't store chat histories indefinitely. Logs of executed actions, on the other hand, should be kept long enough to trace incidents; that is also a security requirement.
• Raise employee awareness: Don't write passwords in the chat, take a quick look at screenshots before sending.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

Step 5: Transparency and co-determination

• Duty to inform (Art. 13 GDPR): Employees learn what data support processes, what for and for how long.
• AI disclosure: Since August 2026, the EU AI Act requires that people are told when they are talking to an AI; see The EU AI Act for MSPs and IT teams.
• Works council: If the system is suitable for monitoring behavior or performance, co-determination rights exist: in Austria under the Labor Constitution Act (Arbeitsverfassungsgesetz), in Germany under the Works Constitution Act (Betriebsverfassungsgesetz). A works agreement regulates that support data is not used for performance monitoring.

Step 6: Consider a data protection impact assessment

A DPIA under Article 35 is not mandatory for every AI support setup, but it is often sensible, especially with many data subjects, long retention periods, access to device data or new technologies. It also helps document your own decisions.

Checklist

1. Update the record of processing activities
2. Establish the legal basis and document the balancing
3. DPA with the provider, including subprocessors and exclusion of training
4. Clarify the data region of storage and model
5. Redaction, deletion periods, logging
6. Inform employees, disclose the AI
7. Involve the works council
8. Consider a DPIA

Related topics: Logging network drive access (logging and data protection) and Mailbox of a departed employee.

How does SuperSupport handle this?

Every step on the device is logged, the agent submits anything sensitive to IT for approval, and users know they are talking to an AI agent. The details (data processing, subprocessors, deletion periods) are in the contract documents. What this looks like for internal IT teams and IT service providers is described on the respective pages.

Frequently asked questions

Can I use an AI assistant in IT support?

Yes, if the data processing rests on a legal basis, a data processing agreement is in place with the provider, transfers of data to third countries are safeguarded and employees are informed. For IT support, legitimate interest or the performance of the employment relationship usually comes into question.

Do I need a data processing agreement with the AI provider?

As a rule, yes. The provider processes personal data (names, devices, chat histories) on behalf of the company. The contract under Article 28 GDPR regulates purpose, duration, security measures and subprocessors, for example the operator of the AI model.

Is an AI provider from the US a problem?

Not automatically. Transfers to the US can be safeguarded through the EU-US Data Privacy Framework or standard contractual clauses. If you want to avoid the topic, choose a provider with storage and model in the EU.

Do I need a data protection impact assessment?

That depends on the use. For an assistant for IT problems it is not always mandatory, but often advisable, especially if chat histories are stored for a long time, behavioral data is analyzed or many employees are affected. If in doubt, clarify it with the data protection officer.

Does the works council have to agree?

If the system is suitable for monitoring employees' behavior or performance, the works council has co-determination rights: in Austria under the Labor Constitution Act (Arbeitsverfassungsgesetz), in Germany under the Works Constitution Act (Betriebsverfassungsgesetz). A works agreement makes clear what the data is used for and what it is not used for.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial