Feature · Document · Written by Yobel Tzegai · Last checked 20 October 2026

How do we record the GDPR facts about each AI system?

In Complipath (complipath.io), each AI system carries four GDPR facts: the kinds of personal data it handles, the legal basis, the purpose and how long the data is kept. A person confirms them, and the card shows who and when. A confirmed record is then offered as the answer to the matching audit question.

Check your AI systems, free

What the app says it does

Per system: the kinds of personal data, the legal basis (the six of GDPR Article 6(1), named), the purpose and how long the data is kept; Live suggests the kinds it saw, with where, a person confirms, and a confirmed record answers an audit's GDPR questions; the six bases are quoted word for word from the Official Journal text of the GDPR once Complipath has approved that text, and named until then.

Illustration · not your dataSystem Candidate Ranking · NorthlaneData and basis Name · Email address · CV or job application · ContractKept until the role is filled · confirmed by a named person

What it does

Per system, the kinds of personal data it handles (from a list of twelve, or a tick that it handles none) and the purpose in up to 500 characters.
Also the legal basis, one of the six of GDPR Article 6(1), and how long the data is kept.
Saving needs the kinds, a legal basis, a purpose and a retention time, unless you tick that the system handles no personal data. Saving confirms the record with your name and the date.
Where Live runs, it suggests the kinds of personal data it saw in your code or logs, each with where it saw them. Suggestions are ticked until a person confirms.
A confirmed record is offered as the answer to an audit question on the legal basis, the retention time, the kinds of personal data or the purpose.
The offer is labelled with the day it was confirmed. A person still confirms the audit answer.
If Live later reports personal data on a system whose confirmed record says it handles none, the record is marked as needing review, with the finding. Confirming again clears it.
The six bases are named. Their words from the Official Journal text of the GDPR are shown once Complipath has approved that text; until then the card says the law text is waiting for review.

What it does not do

It does not choose the legal basis or test it. A person picks one of six, and there is no default.
It does not check that a basis is open to you. Point (f) of Article 6(1) does not apply to processing carried out by public authorities in the performance of their tasks.
It never suggests how long data is kept. Only the company knows that, so a person types it.
Without Live nothing is suggested: you tick the kinds of personal data yourself.
It records those four facts only: no requests from data subjects, no processors and no transfers.

Which plan

Every plan, including the free first system: the app checks no plan for it. The audits that use the record are Starter and up.

Where it sits in the law

It is not an EU AI Act duty. It records GDPR facts beside the AI Act ones.
Article 6(1) of the GDPR: processing is lawful only if and to the extent that at least one of the six conditions listed there applies. The legal basis field names those six; which one applies is for you to decide.
Points (b) and (e) of Article 5(1) of the GDPR name the principles of purpose limitation and storage limitation. The purpose and retention fields record what a person writes and do not test it against them.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Does GDPR basics tell us which legal basis to use?

No. It lists the six legal bases of Article 6(1) and records the one a person chooses, with no default. It does not test whether that basis applies to your system, and it does not suggest how long data is kept. Those decisions stay with the company.

Where do the suggested kinds of personal data come from?

From Live, a Growth feature that is open today to pilot workspaces. When it finds personal data in a prompt, such as an email address, the card suggests that kind and shows where it was seen. Without Live nothing is suggested, and suggestions stay ticked only until a person confirms.

How does it reach an audit answer?

When an audit asks about the legal basis, retention, the kinds of personal data or the purpose, confirmed records with no review flag are offered as one line per system, if each has a value for it. A person confirms the audit answer, and an earlier audit answer or a Data answer comes first.

Which plan includes it?

Every plan, including the free first system: the app checks no plan for it. The audits that use the record are Starter and up. Free holds one AI system, with no end date. Starter is €499 a month for up to 20 AI systems. Prices exclude VAT. Growth and Scale are not available yet, and nothing here waits for them.