News

Generative AI at work without leaking data: a minimum policy

How to use generative AI at work without leaking data: what must never go in, authorised tools and accounts, review and logging, with ready-to-adapt text.

Published By BDR Group8 min read

A minimum generative AI policy fits on one page: which data is never entered, which tools are authorised and with which account, who reviews the output, what is logged and what to do if something has leaked. It works within Llei 29/2021 (Andorra’s data protection law) in Andorra and within the GDPR in Catalonia and Spain.

Which data must never be entered

The rule is simple: none of this goes into a tool that is not on the authorised list.

  • Personal data of customers, patients, employees or candidates: names, identity documents, addresses, emails, histories.
  • Special-category data: health, trade union membership, beliefs, sex life, genetic or biometric data. Llei 29/2021 prohibits processing them except in the cases it provides for (Article 9).
  • Contracts, offers, financial information and any document with a confidentiality clause.
  • Passwords, access keys, certificates and network configurations.
  • Source code, your own or your customers’.

The legal reason is twofold. Personal data must be limited to what is necessary (Article 5.2.c of Llei 29/2021), and a provider that processes it on behalf of the company is a processor: this requires a written contract (Article 31 of Llei 29/2021; Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation or GDPR) and, if the service is outside Andorra and the EU, the regime for transfers (Articles 42 to 44).

Authorised tools: how a tool gets onto the list

Before authorising one, ask the provider in writing for five things: whether it uses the data to train or improve the service, how it handles metadata and logs, where the data is stored and for how long, whether there is a business tier that you administer, and whether the contract includes a no-reuse clause and a processor contract.

The Spanish Data Protection Agency (AEPD, Agencia Española de Protección de Datos) published its internal generative AI policy in November 2025 and a summary of obligations and recommendations in January 2026. It is designed for the AEPD’s own processes, not for companies, but it covers the same points: assess before contracting the use of data for training, metadata, location and retention; contract the business tier with no-reuse clauses; and prevent personal or confidential data from being entered into systems that are not explicitly authorised. At the date of consultation we have not found any guide from the Andorran Data Protection Agency (APDA) specifically on generative AI for companies.

Company account or personal account

The company account is what lets you sign a contract, manage users, switch off the sharing or training options if the provider offers them, and withdraw access when someone leaves. A personal account does not: the terms are those of whoever created it, the company cannot audit them and the information ends up in a space it does not control. That is why the policy should say that personal accounts are not used for work. Terms change by plan: ask for them in writing.

In Catalonia and the rest of Spain, the company must set criteria for the use of digital devices with the participation of workers’ representatives and inform the team (Article 87.3 of Ley Orgánica 3/2018, Spain’s organic law on personal data protection and digital rights). In Andorra, the APDA recommends giving each worker the internal procedures and providing training.

Human review and decisions about people

A language model calculates which word is most likely to come after another; it does not know what is true, as the APDA reminded readers in an article in November 2025. That is why the output is a draft that a person reviews: figures, quotations and legal references are checked before use.

There is a stricter limit: a person has the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or significantly affects them (Article 25 of Llei 29/2021; Article 22 GDPR). No recruitment, credit or disciplinary decision should depend on a tool alone. In addition, the EU Artificial Intelligence Act, as worded in 2026, asks those who use AI systems to take measures to promote AI literacy among their staff, without requiring a specific level (Article 4).

Records and incidents

Keep a list of authorised tools with the owner, purpose, types of data allowed, approval date and contract. If a tool processes personal data, it should appear in the record of processing activities (Article 34 of Llei 29/2021), which the APDA recommends keeping internally.

If someone has pasted data that should not have been pasted, they must tell the person responsible straight away. If personal data is involved and the breach may pose a risk to people’s rights and freedoms, it must be notified to the APDA without undue delay and, where possible, within 72 hours (Article 36 of Llei 29/2021; Article 33 GDPR).

Base text of the policy

Adapt this text to your company:

  1. Only the tools on the authorised list are used, with the company account.
  2. Personal data, special-category data, contracts, confidential information of the company or of third parties, keys and passwords are not entered, unless the list says a tool allows it.
  3. The output is a draft: whoever uses it reviews it and is accountable for it.
  4. No decision about people is taken solely on the output of a tool.
  5. New uses are approved beforehand with [person responsible].
  6. If data that should not have been entered has been entered, [person responsible] is told straight away.
  7. The company keeps a record of the tools and the authorised uses and reviews the policy every six months.

A private alternative

We have an interest in this topic: MIA is a private corporate AI assistant and a BDR Group product. According to the product website, company data does not train public models, access is defined by team, role or area, there is traceability and it can be deployed in a private cloud, a dedicated environment or on-premises. It can be the authorised tool on the list, but it does not replace the policy: the rules of use, human review and logging are still necessary.

What to do now

  1. Ask the team which tools they use and with what information.
  2. Draw up the list of authorised tools, with the processor contract reviewed.
  3. Adapt the base text, inform everyone and run a short training session.
  4. Decide who approves new uses and who receives incident alerts.
  5. Review the policy every six months and every time a tool changes.

Frequently asked questions

Do all free tools have to be banned?

You do not have to ban everything, but company data must not be entered into them. Banning without an alternative rarely works; an authorised tool and clear rules are better.

How long is there to notify a personal data breach?

Without undue delay and, where possible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people.

In Catalonia, do I have to consult workers’ representatives?

Article 87.3 of Ley Orgánica 3/2018 says that the criteria for the use of digital devices are drawn up with the participation of workers’ representatives and that workers must be informed of them.

Sources

Want a private AI that works with your company’s documents?

If you want to see how a private assistant can work with your documents, see the service page: MIA, the private corporate AI assistant. Product details are at mia360.ad.

Back to News

News

More articles