When a company studies a generative AI project, the discussion often focuses on prompts: can this text be sent to the model? In reality, the data flows through a much larger chain. Documents are imported, cut up, vectorized, cached, logged, cited, copied into tools, and sometimes retained to improve the service.
An agent adds yet other flows: persistent memory, connections to messaging, CRM or files, calls to sub-agents, and actions performed on behalf of the user. Compliance with the GDPR therefore cannot be assessed based solely on the provider's interface.
This article proposes a technical mapping method and does not constitute legal advice. Choices must be validated with the DPO and the appropriate advisors.
The model is only one component of the processing
A generative architecture can include:
- a web or mobile interface;
- an application backend;
- a bridge of models;
- a LLM provider;
- an embeddings service;
- a vector base;
- an OCR;
- documentary sources;
- business connectors;
- a conversation memory;
- logs, traces, and analytics;
- a support tool;
- backups.
Anyone can receive personal data. A self-hosted component reduces certain transfers, but does not eliminate the obligations of purpose, minimization, security, duration, and rights.
Start with the purpose
The question 'can we use this data?' has no abstract answer. It is necessary to describe the specific purpose: helping an advisor find a procedure, drafting a response, filing a request, extracting an invoice, or preparing a decision.
A vague purpose such as 'improving efficiency through AI' does not make it possible to determine the necessary data. A precise purpose helps to exclude:
- useless columns;
- documents outside the scope;
- the full history when one period is enough;
- the identities when pseudonymous references are appropriate;
- content logs when aggregated metrics are sufficient.
Minimization is conceived before ingestion, not just after an incident.
Map the entire chain
For each flow, document:
- the source;
- the categories of data;
- the people concerned;
- the purpose;
- the recipient;
- the role of each actor;
- the country or region;
- encryption;
- the duration;
- the deletion;
- the possible use for training;
- human and machine access.
The mapping must cover temporary and indirect copies. A prompt can appear in observability traces, a support capture, or a backup for longer than in the main application.
Data flow of an agentic RAG from the user and the documents to the model, the tools, the logs, and deletion.
Qualify the data without underestimating indirect identification
A name or an address is obviously personal. Other elements can identify a person by combination: file number, position, location, rare event, verbatim, metadata, or history.
Pseudonymization replaces an identifier with a controlled reference, but the data remains personal if re-identification is possible. Anonymization requires a stronger and contextual analysis. The EDPB guidelines published in 2026 remind that the assessment depends notably on the means reasonably likely to be used by the relevant actors.
So avoid labeling a corpus as 'anonymous' solely because the names have been removed.
Determine the roles and responsibilities
The company may be a data controller for the business purpose and use subcontractors. The provider may also process certain data for its own purposes according to its offer and terms. Roles must be analyzed, not deduced from a marketing slogan.
Check:
- documented instructions;
- subsequent subcontractors;
- treatment areas;
- transfers outside the European Economic Area;
- security;
- incident notification;
- rights assistance;
- deletion and restitution;
- audit;
- change of model or policy;
- use of content to improve the service.
A 'data not used for training' mode does not answer all questions: content can still be retained for security, support, or logs.
Choose and document the legal basis
The legal basis depends on the purpose, the relationship, and the context. An internal tool, a customer service, scientific research, and recruitment processing are not analyzed in the same way.
The technical team must not automatically select 'legitimate interest.' It provides the DPO with factual elements: necessity, data, people, impact, alternatives, and measures. Consent must not be used when it is not freely given or when the service cannot actually operate without processing.
When particular categories of data are involved, additional conditions apply.
Design the RAG with data protection
A RAG can reduce hallucinations and limit the need for fine-tuning, but it creates an index derived from the documents. Embeddings should not be considered anonymous by default. They can reveal information or allow linkages depending on the context.
Useful checks include:
- filtering of sources before ingestion;
- access rights propagated to the index;
- separation by tenant or domain;
- minimal metadata;
- encryption;
- synchronized deletion between source, chunks, and index;
- citations with authorization control;
- leak tests between users;
- versioned reindexing.
A single vector database accessible by everyone is a common mistake when the original documents have fine-grained rights.
Frame prompts, outputs, and feedback
The user can enter more data than necessary. The interface must inform them and, whenever possible, detect or hide certain categories before submission.
Outputs can repeat a source data, infer information, or combine several elements. They are therefore subject to the same access and retention controls.
The "good/bad answer" feedback can contain the full text and become an improvement corpus. Define who can read it, how long it is retained, and whether it is reused for training or evaluation.
Mastering logs and observability
Without traces, it is difficult to explain a mistake. With comprehensive traces, the company creates a new sensitive base. It is necessary to separate:
- technical metrics without content;
- correlation identifiers;
- sampled prompts and outputs;
- stock journals;
- errors;
- safety data.
Apply access control, encryption, masking, short duration, and audit. Detailed logs can be temporarily enabled for an incident with a defined procedure.
Manage memory and agents
A persistent memory can accumulate preferences, relationships, health, opinions, or habits. It must be visible, editable, and deletable. Its scope is limited to what actually improves the service.
For an agent, each connector extends processing. In July 2026, the CNIL and CIANum highlighted the risks related to circulation between services, persistent memory, hyper-personalization, and the difficulty of assigning responsibilities.
The principle of least privilege applies: access on request, limited scope, short duration, confirmation for sensitive actions, and user-understandable logging.
Prepare the rights of individuals
The company must be able to find, correct, export, or delete relevant data. This involves linking the identity to the different layers without creating an even more intrusive index.
Test the path:
- find the prompts;
- identify the source documents;
- delete chunks and embeddings;
- empty the memory;
- handle backups according to the policy;
- correct a source data;
- avoid its reappearance during the next indexing.
A theoretical right without a technical procedure is difficult to exercise.
Determine if a DPIA is necessary
A data protection impact assessment may be required when the processing is likely to result in a high risk. Factors include in particular monitoring, sensitive data, vulnerable individuals, scale, combination, innovation, and significant decisions.
Even when it is not mandatory, a structured analysis helps to compare architecture variants and measures. It must be updated when there is a change in purpose, model, data, or autonomy.
Do not confuse training, fine-tuning, and usage
A provider may not use prompts for training while running processing on its infrastructure. Fine-tuning can memorize examples. A RAG keeps data in an index. Each mechanism produces distinct risks.
For training or customization, document the origin, rights, necessity, filtering, extraction tests, durations, and withdrawal capability. Large-scale harvesting of personal data is subject to guidelines from the EDPB published for consultation in July 2026.
A privacy by default architecture
A robust solution combines:
- data classification;
- centralized gateway;
- models allowed per level;
- masking before sending;
- spread access;
- minimal retention;
- controlled logs;
- regions and contracts verified;
- leak tests;
- rights and incident procedure.
Partitech can carry out the technical mapping, design access controls, indexing, the gateway, and deletion mechanisms. The DPO and the company's advisors validate the legal bases, information, and analyses. The expected result is an architecture whose flows are known and controllable, not an abstract promise of confidentiality.
Let's talk about your project
Map and secure the data flows of your AI project with Partitech, your DPO and your advisors. Contact Partitech.