Before a pilot, understand both what the tool can do and what happens to the information entrusted to it.
DPA · Practical guide · 27 October 2026
01
Where does the data go?
Ask for data flows, storage and processing locations and subprocessors. Check whether transfers outside the EEA take place.
02
Is it used for training?
Distinguish inputs, outputs and technical logs. Check contractual terms and whether training opt-outs cover all of them.
03
How can you exercise control?
Check access permissions, deletion periods, export options and incident procedures. Request evidence of relevant safeguards.
04
Who checks the output?
Assign a person able to assess the output and stop its use. Record limitations and prohibited applications. For example, do not use real customer files in a test without a prior assessment.
Related guidance
Legal framework: Regulation (EU) 2016/679 (GDPR), Articles 5–6, 28, 32, 35–39 and Chapter V.
Data protection in Bulgaria — knowledge base ↗