GDPR and generative AI: what changes for anyone working with client documents
Using AI for client work adds a recipient to the workflow. Before you paste, decide what that recipient needs to see.
Sharing data is part of the task
An accountant might ask ChatGPT to draft a plain-English explanation of a tax letter. A corporate advisor might ask Claude to extract obligations from an engagement document. In either case, pasting client information into the prompt sends that information to a third-party AI service for processing.
That is a practical data-handling decision, even when the task feels routine. The document may include personal data about the client, directors, employees or contacts. A prompt can also expose context: who is involved, what transaction is under discussion and what the professional firm has been asked to do.
GDPR questions depend on the circumstances, the service and the organization’s arrangements. A firm may need to consider its lawful basis, its obligations to clients, its agreement with the provider, access controls, retention settings and any rules it has set for staff. Those questions require the firm’s own assessment. A masking tool cannot answer them on its behalf.
Minimize before you send
Data minimization asks a direct working question: do you need this personal data for this purpose? If you want an AI to improve the wording of a client letter, it may need the argument and the tone. It may not need the client’s tax code, email address or IBAN.
Start with the job you want done. For example: “Turn these notes into a checklist of filing steps.” Then look at the material you plan to paste. Remove irrelevant pages and passages. Consider whether names can be replaced consistently so the AI can still tell people apart. Check whether dates, amounts or locations are necessary to the answer. A useful prompt is usually more focused than the document it came from.
Riducta supports this step. It detects tax codes, IBANs, VAT numbers, emails and telephone numbers in supported formats. You indicate or confirm names to mask, review the prepared text, and choose what to paste into ChatGPT or Claude. The preparation runs in your browser. The AI receives the text you actually send.
Treat the review as essential. Automated detection can miss an unusual format, and a document can identify someone through its context without displaying a standard identifier. Read for both. If the remaining text still reveals a sensitive matter, change the prompt, remove more detail or choose a different way to do the work.
Why deleting the chat is not the same decision
Deleting a conversation from your chat list happens after you have shared its contents. It cannot undo the original disclosure. What the provider does with submitted text, what records may remain and what controls are available depend on the service, account and applicable terms or settings.
That is why a deletion habit cannot replace a decision made before pasting. You may still need to manage conversations under your firm’s policy. But the earliest opportunity to limit what the provider receives is while the document is still in front of you.
Think of an engagement letter containing scope, fees, contact details and payment instructions. To ask an AI for a clearer scope summary, you can supply the relevant clauses while withholding the real names and bank details. The AI can work with stable placeholders such as [CLIENT] and [FIRM]. If the answer later needs those values for an internal draft, Riducta can restore them from the response you paste back.
Restoration is a convenience, not a substitute for checking the answer. The model may omit a clause or misunderstand a fee condition. Compare its output with the original document before you rely on it, and review the restored text before it goes to a client or colleague.
Make the choice repeatable
A firm does not need a new theory every time someone opens an AI chat. It needs a workable sequence. Define the task. Select the necessary text. Review personal data and identifying context. Apply the firm’s rules for the AI service. Paste only the text approved for that task. Check the answer against the source.
A short internal example can help: “For a contract summary, replace party names and contact details unless their identity is necessary to the requested analysis.” Another task may call for a different decision. The point is to make the decision explicit and reviewable, especially when work moves quickly.
Riducta fits into that sequence as a tool for preparing and reviewing text before sharing it. It helps minimize what you send; the user and the firm remain responsible for deciding whether to use the AI service and whether the remaining text is suitable. For a document you are ready to assess, start at riducta.com. Free for a single document, Pro for working every day.
ChatGPT is a trademark of OpenAI; Claude is a trademark of Anthropic. Riducta is not affiliated with or endorsed by either.