When you think about AI assistants and GDPR, start with the mailbox. Email is full of personal data: names, addresses, complaints, contracts and the occasional private remark. When an AI assistant reads it, the rules on personal data apply to that use. This article lists what companies usually write down before launch. It is general information, not legal advice, so check your own situation with a lawyer.

Why this matters for AI and mail

A mailbox is a record of everything a company says and hears. Once an assistant can search it and summarise it, your processing changes: there is a new tool, often a new vendor and a new way to access old messages. Regulators and customers will ask about it in that order, so write the answers before they ask.

What to write down

1. PurposeWhy you use the AI, in one sentence a customer would understand. For example: faster, more accurate answers to customer questions.
2. Legal basisThe reason your company may process this data in this way. Decide it with your data protection officer or lawyer, and record it.
3. ScopeWhich mailboxes and data types are in, and which are excluded. Data filters make the exclusions concrete.
4. VendorsWho processes the data, in which region and under which contract. Include the AI provider as well as the connection provider.
5. RetentionHow long requests, answers and journal entries are kept, and who can delete them.
6. SecurityAccess control, logging and filters, described the way an auditor would read them.

A record you can fill in

One page is usually enough. Here is a layout you can copy. The entries are examples, so replace them with your own.

Common mistakes

• Writing the policy after the tool is live.
• Documenting the AI provider but forgetting the connection provider.
• Leaving scope vague, so nobody can say which mailboxes were in.
• Keeping a journal that nobody reads.
• Treating a pilot as outside the rules because it is small.

Impact assessment

If the use is large, or touches sensitive categories of data, consider a data protection impact assessment. It is far easier to do before launch than after a complaint. A small pilot with a defined group is a good way to gather the facts the assessment needs.

People's rights

Employees and correspondents can ask what is done with their data. You should be able to find the relevant records and explain them. A journal of AI requests helps here, because it shows who used the AI, when and which tool ran. In AddSync AI the AI reads a message to answer and does not store it, and the journal holds no mail text. Ask every vendor the same question about storage and retention.

Tell your staff

Update your internal policy and say clearly what the AI may be used for and what it may not. People follow a rule they can read on one page. Add the approval rule too: the assistant suggests and the person confirms anything that changes data.

A short checklist

• Purpose and legal basis written down and approved.
• Scope and exclusions defined, with filters configured to match.
• Vendor list with regions and contracts.
• Retention period decided.
• Journal switched on and a named person who reviews it.
• Staff policy updated and communicated.

Our approach is described in the privacy policy and on the trust page.

Questions and answers

Do we need a data protection impact assessment?

It depends on scale and on the kind of data. Ask your data protection officer or lawyer. When in doubt, do the assessment while the pilot is still small.

Does the AI vendor become a processor?

Often yes, but it depends on the setup and the contract. Ask each vendor to state its role in writing.

Is this legal advice?

No. It is a practical list from a software vendor. Your own lawyer decides what applies to you.

Where do the filters come in?

Filters keep chosen folders, senders and keywords away from the AI. They turn a policy sentence into a technical control.

Written by the AddSync team.