GDPR, security & digital sovereignty — without the handbrake

In the German Mittelstand, governance is not an accessory but the condition for the rollout. The data protection officer, procurement and the works council all have a say. According to Bitkom 2025, only 23 % of companies have fixed rules for using AI — 77 % work without governance. This chapter shows how to set up security, procurement and co-determination so that they carry the rollout instead of slowing it down.

Data protection per use case — not all or nothing

Most providers force a single data protection setting on the whole company. We split it into four levels, configurable per use case. The chosen level determines the permitted sub-processors — and with them the content of your data processing agreement.

One mid-sized manufacturer deliberately takes its GxP processes out of scope and runs level 1, while the marketing department in the same building uses level 4 with the PII filter. Every task stays at the protection level that fits it.

Local sources stay under your control

The Outpost runs inside your network and indexes approved folders locally. It connects outbound to meinGPT; no inbound internet port is required. For each resource, you decide whether relevant text excerpts or original files may be provided to a use case. Here, on-premise means a controlled data path — not a blanket promise that no data is ever transferred.

Azure OpenAI EU DataZone — verifiable, not promised

The data protection officer's most common objection is: "OpenAI means the USA, so it is forbidden." That is true for the standard API. We use the Azure OpenAI Service in the EU DataZone: the same GPT models, but without access by OpenAI, without use for training, and with processing exclusively in the EU.

The decisive part: you can check it yourself. One Azure CLI command shows that abuse monitoring is switched off.

az cognitiveservices account show -n resource_name -g resource_group
# shows "ContentLogging": "false"

Write access — start restrictive, release under control

Read-only integrations are the safe default posture: the RAG search index searches your knowledge without changing anything. Where AI is meant to act in systems, JWT identity forwarding applies: meinGPT passes a signed token (RS256, valid for one hour) to the target system, which securely identifies the user and the organisation. Write access becomes auditable that way and inherits the permissions from the source system. The admin starts restrictive and releases methods and scopes under a policy.

Procurement your buyers can sign

We produce the data processing agreement in two to three working days — including full technical and organisational measures, a register of sub-processors for your chosen level and the data protection information on the models. Our external data protection officer is heyData. Data subject rights under Art. 15 and 17 GDPR can be handled automatically.

The works council — involve them early, roll out fast

Co-determination under § 87 BetrVG (the German Works Constitution Act) is real, not optional. The Hamburg Labour Court (case 24 BVGa 1/24) held that the moment a company buys corporate licences, the right of co-determination arises. There is no trick that gets around it.

Involving the works council early prevents open questions from surfacing only during the co-determination process and delaying the rollout. That is why anonymised usage metrics and documentable purpose limitation are product features, not promises — and why a template works agreement is part of the service.

Sovereignty is an architecture, not a label

Geography is not jurisdiction. Before the French Senate, Microsoft confirmed under oath in June 2025 that US authorities can access EU data through the CLOUD Act — even inside the EU Data Boundary. A server in Frankfurt alone does not solve that. When a large European corporation announced its exit from the cloud in December 2025, that was a signal to the Mittelstand.

Our answer is structural: multi-model instead of single vendor, EU hosting by default, four data protection levels and a PII filter. The platform is made and hosted in Germany (Hetzner, renewable energy), externally pentested (SySS) and backed by a bug bounty programme.

Where to read on

Governance does not decide the whether of a rollout but the how. How write access reaches deep into your systems in practice is shown by automation. How to win the works council as an ally is covered in change management. And how the whole rollout is ordered in stages is in the strategy as well as in the concrete sequence under rollout.