AI tools often process personal data: user inputs, customer documents, HR data. KIND helps you link each use to its processing activities, legal basis and GDPR and AI Act obligations, so you regain control of the data used by your tools.
The GDPR protects personal data, the AI Act regulates AI systems according to their risk level. In practice, both converge on the same elements: the purpose of the use, the data processed, the vendor, human oversight and evidence of decisions. Handling them together avoids documenting the same choices twice.
Link each use of AI to the record of processing activities, carry out the DPIA, check contracts and transfers. KIND provides the mapping and the technical elements to do so.
Arbitrate uses, roll out clear rules, train teams. KIND helps you turn obligations into an operational action plan.
Yes, as soon as personal data is processed: user inputs, imported documents, training or fine-tuning data. The company must identify its legal basis, inform individuals, limit data and supervise the vendor.
A data protection impact assessment (DPIA) is required when processing is likely to result in a high risk to individuals' rights and freedoms. Many AI projects fall under it. The CNIL publishes recommendations on the subject (in French).
The DPIA comes from the GDPR. The fundamental rights impact assessment is provided for by Article 27 of the AI Act for certain deployers of high-risk systems. Both can rely on the same starting elements.
Hosting and any transfers outside the European Union, the data processing agreement, whether data is used to train models, retention periods, security measures and the ability to exercise individuals' rights.
The GDPR regulates decisions based solely on automated processing when they produce legal or similarly significant effects. Individuals have specific rights, and real human intervention must be possible.
A conversation lets us frame your uses, vendors and priorities, with no commitment on your side.