First understand the data flows
Map out the path the data takes. Take a chatbot: a visitor types in a name and phone number. Where does that end up? With the AI provider, with us, in your inbox? And what happens to the conversation history? As soon as data can be attributed to a person, you need to look more closely.
Check service providers
If an external provider processes the data, you usually need a contract with them, such as a data processing agreement. Also ask: where are the servers? Which subcontractors are involved? Are the inputs used to train the model? If this isn't clearly stated in the documents, ask in writing.
Data minimisation
Give the AI only what it needs for the task. To assign a customer inquiry to a category, it needs to know neither a date of birth nor an account number. Where possible, data is anonymised or pseudonymised beforehand.
Transparency and labelling
People who write or speak with an AI should know it. For example with a notice such as "I am an AI assistant" right at the start. How the data is processed also belongs in the privacy notice.
Human oversight
If a result directly affects a person, such as a rejection of a job applicant, someone reviews it beforehand. Record in writing who is responsible for what at your company.
When you should involve legal advice
At the latest here you should seek expert advice: with special categories of data such as health data (so every doctor's practice and physiotherapy), with professional confidentiality obligations, and when data goes to third countries outside the EU and EEA.