AI and data protection Using AI under the GDPR: where your data goes, and what to check.
Once minutes, a contract or a patient file goes into an AI tool, you are processing personal data — with every GDPR duty attached. Here is where the data goes with cloud AI and with Butler, what Schrems II and the CLOUD Act mean, and what your data protection officer should check first.
- Built for the GDPR
- No transfer to a US cloud
- Never used for training
Where the data goes
The one question that decides everything: where is it computed?
Every AI request is computation on graphics cards. What matters is where they are, who runs them, and which law applies. With Butler that depends on the version:
The vendor’s data centres
Cloud AI assistants
Every prompt and file is processed on the vendor’s servers — for the large vendors, a US company, even with EU data centres.
Our GPUs at TU Wien, Vienna
The subscription
Everything runs on our servers at the Institute of Applied Physics, TU Wien. Your data is stored there and deleted automatically every two weeks — with no copy in a cloud or with a third party.
Your office, heavy AI at TU Wien
The portable version
A computer in your office. Documents, recordings and speech recognition stay with you. Heavy AI inference — chat, summaries, translation, research — runs on TU Wien’s servers, not with a cloud provider.
Entirely on your premises
The complete version
A GPU server in your building. Transcription, chat, translation and research all run on site; not a byte leaves, and Butler keeps working without an internet connection. For up to 50 people; larger institutions on request.
No version sends a request to a US cloud provider. But with the subscription or the portable version, we process data on your behalf at TU Wien — and that belongs in your documentation. The offers and prices →
The US transfer, in plain words
Schrems II and the CLOUD Act in two paragraphs.
The CLOUD Act is a 2018 US law. It obliges providers subject to US jurisdiction to hand over data when ordered to by US authorities — including data stored on servers outside the United States. An EU data centre run by a US company changes where the data sits, not whose law applies to it.
In its Schrems II ruling of 2020, the Court of Justice of the EU struck down the Privacy Shield because US surveillance law did not adequately protect Europeans’ data. Since 2023 the EU–US Data Privacy Framework has offered a new basis for certified companies; whether it will hold up in court remains open. In practice: AI from a US vendor means assessing and justifying the transfer. Data processed in Europe — or in your own building — never raises the question.
Training
Your data trains no model. None.
Business tiers of cloud offerings typically exclude training on customer data by contract; on free and personal tiers it often depends on a setting. Check the tier your people actually use.
Butler has no such distinction: not a byte of your work is used for training — not for our models, not for anyone else’s.
Checklist
What your data protection officer should check first.
The GDPR asks nothing fundamentally new of AI — just everything usual, properly documented. These points apply to any AI tool, Butler included.
- 1
Data processing agreement (DPA)
If a provider processes personal data on your behalf, you need a contract under Art. 28 GDPR. With Butler that covers the subscription and the portable version. With the complete version nobody but you processes the data — if we access it for maintenance, cover that access too.
- 2
Technical and organisational measures (TOMs)
Access control, encryption, logging, deletion: ask for a description (Art. 32). With the complete version the measures are your own.
- 3
Data protection impact assessment (DPIA)
New technology plus sensitive data — health, HR, large volumes — often makes a DPIA under Art. 35 mandatory. The less data leaves the building, the shorter the chapter on transfers.
- 4
Records of processing activities
Log the AI use with its purpose, data categories, recipients and retention periods (Art. 30). “Meeting transcription” and “document search” are two different purposes.
- 5
Deletion and retention
Decide how long transcripts, chats and documents are kept. On the subscription we delete every two weeks; on the portable and complete versions you decide — and deleting in Butler destroys the data, its vectors and its index entries.
- 6
Informing the people concerned
Anyone who is transcribed or recorded in a knowledge base has a right to be informed (Art. 13/14). Update your privacy notices before the tool goes live.
Whether your processing complies is yours to establish — no vendor can certify it for you. Butler is built to make that assessment easy.
EU AI Act
What the AI Act asks of organisations that use AI.
The AI Act, Regulation (EU) 2024/1689, entered into force in August 2024 and applies in stages. If you use AI in your organisation you are a “deployer” — with duties that depend mainly on what you use it for, not on the tool.
AI literacy
Since February 2025, deployers must make sure their staff know enough about the AI they use. A short, documented briefing is a good start.
Transparency
In certain situations people must be told that they are dealing with an AI or with AI-generated content. Work out where that applies to you.
High-risk purposes
Hiring, creditworthiness, access to education or public services: stricter duties apply here — human oversight, logs, use according to instructions. An assistant for minutes and research usually does not fall into this category.
Deadlines and guidance are still evolving. Check the current state with your supervisory authority or legal counsel.
Recording meetings
No consent, no recording.
Recording a conversation in secret is not just a data protection issue. In Austria (§ 120 StGB), Germany (§ 201 StGB) and France (art. 226-1 of the Code pénal), recording private conversations without consent is in principle a criminal offence. If you transcribe meetings, be sure everyone knows before every recording.
Butler turns that into a hard gate rather than a good intention: a recording starts only once you confirm that every participant has been told — for every single recording.
Confirmed per recording
Not a setting you click away once. The confirmation is stored with the recording.
No bot in the call
Butler never joins a meeting. It records the sound your computer already plays — visible to you, never hidden.
Local speech recognition
Whisper large-v3 and speaker detection run on Butler’s own GPUs. No transcription API, no cloud.
This page is general information, not legal advice. Whether your processing complies with the GDPR is for you to assess with your data protection officer.
Questions
Is Butler GDPR-compliant?
Compliance belongs to a processing operation, not to a product — and it is yours to establish. Butler is built for the GDPR: processing in Vienna or on your premises, no US cloud provider, no training, deletion under your control. That makes your assessment much simpler.
Does data leave my building with the portable version?
Partly. Documents, recordings and transcription stay with you. For chat, summaries, translation and research, the text needed goes to TU Wien’s servers in Vienna. If nothing may leave at all, you need the complete version.
Do I need a data processing agreement?
For the subscription and the portable version, yes, because data is processed on our servers. With the complete version only your own machine processes it; an agreement may still be needed if we access it for maintenance or updates.
Isn’t an EU data centre of a US vendor just as good?
It settles where the data is stored, not which law applies: under the CLOUD Act, US authorities can request data from European data centres too. Whether that risk is acceptable for your data is a judgement you have to document.
Is my data used for training?
No. Nothing you do in Butler trains a model — not ours, not anyone else’s.
Does Butler work offline?
The complete version does: it computes everything on site and keeps working without an outside connection. The subscription and the portable version need a connection to TU Wien.
Let’s go through your data protection questions.
Bring your data protection officer: we show you, on the machines, where each piece of data is processed and how it is deleted.