Connecting your email to your CRM and to an AI model is processing personal data. You do not need to be a lawyer to automate sensibly, but you do need four things clear that most people discover late.
1. Decide where the data lives
Every step of a flow processes data on someone's servers. n8n Cloud hosts in the European Union and self-hosting n8n gives you full control over the region; with US providers, check they are certified under the EU-US Data Privacy Framework. The right question before choosing a platform is not “which apps does it connect?” but “where does my data travel?”.
2. Sign the processing agreement with every provider
Every service that processes data on your behalf — the automation platform, email, hosting — is a data processor and needs its agreement (DPA) and its list of sub-processors. Our own privacy policy shows how we document this with Cloudflare, Google and n8n: that transparency is exactly what you will owe your own users.
3. Minimise what AI models touch
A flow using AI does not mean the model must see personal data. Before sending anything to an LLM: strip what it does not need (an email classifier does not need the sender's ID number), pseudonymise when you can, and make sure by contract that the provider does not train on your data. The flows we build minimise what reaches the model by design.
4. If there is a bot, it must introduce itself
The European AI Act (Regulation (EU) 2024/1689, Article 50) requires informing people that they are interacting with an artificial intelligence. An assistant that answers emails or messages must identify itself as one. Building this in from day one is trivial; retrofitting it later is not.
- Minimum checklist: a clear legal basis for each processing activity, an up-to-date record of processing, a DPA signed with every provider, a defined retention period, an identified bot and an easy way to exercise rights.
- This guide is informative, not legal advice: for sensitive data or high volume, consult a professional.