GDPR and EU AI Act

Designed to support compliance and make it demonstrable.

Compliance isn't a tick box from a supplier but a chain of measures you can show to a supervisory authority. This is what PrivaSearch contributes to it — and what remains yours.

GDPR

Privacy by design, verifiable.

Data minimisationOnly pseudonymised text leaves the review step; originals stay in the shielded storage of your own environment within PrivaSearch.
Pseudonymisation (Art. 4 and 32)Consistent pseudonyms per project, mapping table encrypted with a separate key.
Accountability (Art. 5(2))Audit log of every view, search, approval, reveal and refused access, without document content in the log.
Storage limitation (Art. 5(1)(e))Retention periods per project with controlled deletion of originals and derived data.
Processing in the EUDesigned with EU hosting as the starting point. Hosting, storage and optional OCR take place in the EU, under a data processing agreement with a list of sub-processors.

EU AI Act

Human oversight, transparency, logging.

No automated decisionsPrivaSearch searches and cites. It doesn't assess people and doesn't take decisions; that supports a classification outside the high-risk categories, depending on the intended use and the workflow.
Human oversight built inNothing becomes searchable without explicit approval by a staff member. The review is mandatory, not optional.
Transparency and source referencesEvery answer refers to the document and page. Users know they're working with an AI search layer and can check the source.
Logging and traceabilityWho, what, when: the audit log supports the documentation obligations and your own AI policy.
AI literacy (Art. 4)A built-in training with periodic refreshers, instead of a ban that employees work around.

Paperwork

Four documents your environment writes itself.

From one form, deterministic and without a language model. The content follows the actual setup of your environment, so it never lists a measure that isn't switched on.

AI policy

Thirteen chapters on permitted and prohibited AI use, roles, incidents and the classification under the AI Act, with appendices on the technical setup and a checklist for employees.
DPIA starter document (Art. 35 GDPR)

A starter document with a check of the DPIA obligation against the nine WP248 criteria, a risk analysis with a gross and net score per risk, the measures and a conclusion on the residual risk. Not a finished legal opinion — review by a lawyer or DPO is necessary.
Register entry (Art. 30 GDPR)

The complete entry for the record of processing activities for this processing — purpose, data subjects, data categories, recipients, transfers, retention period and measures — ready to paste into your own register.
Lawful basis and balancing of interests

The lawful basis per processing purpose, the three-step balancing test for legitimate interest and, for special categories, the exemption under Art. 9(2).

Honestly: automatic detection is never complete. That's why the human review is mandatory and PrivaSearch always shows the original next to the pseudonymised text. The rest of your record of processing activities, the advice of your data protection officer and the formal adoption remain yours: they're starter documents, not legal advice.

See in twenty minutes what happens to your documents.

We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.

Book a demo →

No credit card, no self-service trial with real data
Data processing agreement and hosting overview available in advance
Set up per organisation, rolled out in days
Built and maintained by Nerdpower Solutions

Privacy by design, verifiable.

Human oversight, transparency, logging.

Four documents your environment writes itself.

AI policy

DPIA starter document (Art. 35 GDPR)

Register entry (Art. 30 GDPR)

Lawful basis and balancing of interests

See in twenty minutes what happens to your documents.