Data and privacy in the SME

An SME does not need a Fortune 500 CISO. It needs rules that fit on a poster next to the screen, and one real example of what never gets pasted. GDPR is the frame; this article is the everyday perimeter.

The typical incident is not sophisticated: someone uploads the customer book “so the model can clean it”, or pastes a live contract, or forwards a thread with an ID scan. A week later nobody remembers which account it was in.

We design the perimeter with the same rule as the pilot: narrow, written, reviewable.

The yes / no / ask poster

• Yes. Internal texts already public inside the firm (FAQ, hours, catalogue without confidential prices), this week’s invoices in the contracted tool, tickets without special categories.
• No. Credentials, health, children, payroll, scanned IDs, customer secrets, entire databases, anything in a personal free account.
• Ask. A new case, a new vendor, an old file, something the model will “only see for a moment”. The moment is forever in a log.

What may leave the network

If the vendor is under contract, with clear residency and no-training, the fields of the flow may leave. If there is no contract, no personal or contractual data leaves. Local models reduce outbound data; they do not permit pasting too much.

“Leaving” includes the browser extension, the phone app and the mail client’s “help me write”. The perimeter belongs to the company, not to one tab.

How to explain it in 30 minutes

Ten minutes on the poster. Ten on three real examples (one yes, one no, one doubtful). Ten on “where to ask” and “how we switch off”. No articles of the regulation. At the end, each person says out loud one example from their desk. That is how you see whether it landed.

Repeat at day 14 with real prompts (no punishment: you fix the perimeter). Fear does not teach. A house example does.

Customers and staff

If the processing is new, the clause or notice must say so in plain words. Do not hide “we may use automated help in handling your order” if a model actually reads the mail. Do not promise you “never use AI” if admin already has a copilot.

Staff deserve to know if their internal tickets go to a processor. Silence produces the worse rumour.

Inventory, GDPR and security

The inventory says what exists. GDPR says on what basis. Security says how the token does not leak. This perimeter says what a person does on Tuesday at 11. You need all four. One alone is a PDF.

Desk examples (for the briefing)

Yes: “summarise this paragraph of our FAQ for the new colleague”. No: “clean this sheet of names, phones and purchases”. Ask: “can I upload this quarter’s invoices to this new tool a salesperson sent on LinkedIn?”. The answer to the last is no, until there is a contract and a vendor card.

Another frequent no: photographing the whiteboard with a candidate’s ID and sending it to the chat “so it can type it up”. The model is not an innocent photocopier. It is a processing.

Leave these three examples on the poster. Abstracts (“personal data”) do not change the thumb. Desk examples do.

Personal accounts and “I will delete it later”

The personal free account is the most common hole. It mixes private life, has no processor contract, and “later” never comes. The briefing ends with a sentence: if it is not in the company tool, it is not pasted. Anyone who already did it says so (no punishment) and you delete what you can.

Leadership sets the example: they do not use their personal ChatGPT on the customer book either. The poster does not hold if the boss is the exception.

When someone new joins, the poster is taught on day one, not “in next month’s AI course”. The silliest incident is the second-day one, with a will to help and a personal account. A short onboarding prevents more than the welcome manual.

If a customer writes that their data must not enter automated-help systems, that is a row on the perimeter, not a “we will see”. The poster is updated. The flow is cut for that customer. Breaking that sentence for convenience is the incident with a name on it.

Frequently asked questions

Can we use a personal account “just for tests”?

Not with real data. Tests with real data are not tests: they are the processing. Use synthetic text or the signed contract.

What if the customer asks us to use AI?

Then the perimeter is agreed with them, in writing. It is not permission to paste the whole book.

Does the poster replace the records of processing?

No. The poster teaches the team. The record (even one page per flow) is your memory. You need both.

Next: GDPR basics and minimum security. We will write the poster with your examples.