Skip to content

About this practice

Status
draft
Endorsement
none yet
Last reviewed
2026-10-27

Best practice 11

Decide where research data may be sent

Practice

Sending personal data to an AI service is itself processing under data protection law: it needs a legal basis, a processor contract, and, for a provider outside the EU, a transfer basis. This holds even when the provider does not train on the data. For personal, confidential, or controlled-access data, use the account or deployment your institution has contracted, check how long inputs are kept and whether they are used for training, and keep such data local when no contracted route exists. Anything an agent using an externally hosted model reads goes to the provider, so keep secrets and protected data out of the directories it can read, preferably by sandboxing your agents.

If you offer an AI service, offer a tier that excludes training and long retention, processes under a contract and in a location that fit the customer's legal regime, and state plainly which legal process can reach the data. Make that tier the default for institutional customers. If your scientific service passes user data to a model provider, say which provider and under which terms, and offer a route that keeps the data in an environment the user's institution governs.

Contract the AI services used by your staff; ensure a processor agreement, exclude use of data for training, and establish the transfer basis; provide institutional accounts, and ensure no one uses a consumer account for work. State which data classes may reach which tier. Hosting in the EU at a provider under US jurisdiction does not by itself remove the reach of US legal process; decide what that means for each data class.

Reasons

Typing data into an AI service, or letting an agent send it, hands the data to the service provider. The user's account tier and the contract determine downstream effects: whether the input can be used to train a model and how long it is kept. For instance, consumer accounts of one provider train on inputs by default and keep them for five years; its commercial tier excludes training and keeps them for 30 days. Service providers fall under their own jurisdictions: a US court ordered another provider to keep consumer and standard-API chats that users had deleted; zero-retention customers were unaffected.

For personal data, the act of sending is already processing under data protection law. It needs a lawful basis, a processor contract, appropriate security, and a transfer basis when the provider is outside the EU. These requirements apply even if the provider never trains on the data. A regulator has treated staff entering patient data into a consumer chatbot as a data breach, although the practice had written rules against it. The EDPB and the data protection authorities of Germany, France, and Spain place the check on the organisation that deploys the service. The EDPS found the European Commission's own use of a cloud office suite under the provider's standard terms unlawful until the contract was renegotiated.

This practice does not restate data protection law or research ethics. It covers what AI changes: the decision to disclose data moves to the moment of use. These decisions are made at institutional level (e.g., via enterprise settings), by single persons (e.g., by deciding what to work on), or even autonomously (in agentic setups). What happens to the data then depends on the provider's terms and jurisdiction.

For an agent on an externally hosted model, this applies to every file it opens, every command output, and every tool result, because they enter the model's context and thus are sent to the provider. Data held under withdrawable consent must also never be committed to third-party training; that irreversible case is screened under BP10. How an agent's limits are enforced in the system, and who answers for them, is BP04.

Examples

  • A researcher's consumer chatbot account trains on inputs by default and keeps them for five years; the same provider's institutional tier excludes training and keeps them for 30 days. The lab's governance decides which account is used for work.
  • A US court orders a provider to preserve all consumer and standard-API chat logs, including ones users deleted; enterprise and zero-retention customers are excluded. A lab on a consumer account has its deleted chats kept for four months; a lab on a zero-retention contract does not.
  • An employee of a general practice enters patients' medical data into a consumer chatbot against the practice's rules, and the national regulator treats it as a data breach (healthcare delivery, outside research). An institutional account under a processor agreement, or a network that blocks the consumer service, would have kept the data in.
  • A social science group transcribes and codes research interviews with an AI service. The transcripts go to the institution's contracted deployment, which runs under a processor agreement with training excluded, and not to a team member's personal account.
  • A coding agent asked to fix a failing script opens the project's .env file to check a setting. The API keys and database password in it are now in the provider's logs under the account's retention terms, and the keys have to be rotated. Keeping secrets outside the directories the agent can read prevents this.
  • An agent analysing survey records runs on the institution's contracted model deployment, so the records reach only a provider under contract. It can also call a web search tool; its configuration lists the services it may send data to, and the search tool receives the query only, never the records.
  • Under the European Health Data Space, an agent working on permitted health data computes inside a secure processing environment and cannot move personal data out of it, to a model provider or anywhere else (health-data instance).

Sources

Change history

  • 2026-10-08: Created from the ingestion on EU data protection and AI-provider terms (Commission living guidelines, EDPB Opinion 28/2024, and decisions and guidance from the EDPS and the Dutch, German, French, and Spanish data protection authorities), in response to challenge #33 and editor review on PR #22. New practice rather than atoms on BP04, because deciding which data may go to which service is a separate action that applies to people using AI tools as well as to agents.

Discussion