On this page
What does the NDA say?
- An NDA limits who you may give confidential information to and for what. Often only your own staff and advisers who need it for the transaction.
- An AI provider is a third party. Whether you may store documents there depends on the wording. Look at the definition of “representatives” or advisers, and at what it says about storage with third parties.
- Mind the duty to return or destroy information afterwards. It covers what sits with the provider too.
- In doubt, ask for consent or raise it when the NDA is negotiated.
Is there personal data in the data room?
Almost always: employment contracts, payroll lists, customer data, correspondence. Then the GDPR applies.
- Whoever decides why and how the data is processed is the controller. An AI provider that processes only on your instructions is a processor.
- With a processor you sign a data processing agreement (DPA). The large providers offer one with their business plans; personal accounts usually have none.
- Share only what is needed. A payroll list does not need to go in for a summary of the leases.
- If data leaves the EU, the transfer needs a legal basis, such as the European Commission’s standard contractual clauses.
- Special categories of personal data, such as health data in absence files, call for extra care.
Which provider settings matter?
- Training: your input must not be used to train models. On business plans that is usually the default; on personal accounts you often have to switch it off yourself.
- Retention: how long does the provider keep inputs and outputs, and can you shorten it?
- Region: where possible, choose storage and processing in the EU.
- Access: who at the firm sees which chats and files, and what happens when someone leaves?
- Logs: can you see afterwards which documents were shared?
What should a firm put in place?
- One business account for the team, with a DPA. Deal work does not go through personal accounts.
- A short internal rule: which documents may go in, which may not, and who decides in case of doubt.
- A standard clause in your NDAs on the use of AI services with appropriate safeguards.
- The settings on record: training off, retention known, EU region where possible.
- A fixed moment when someone checks it is still so.
Is this legal advice?
No. This is the general Dutch and EU frame. Wouter Dijkman is a lawyer by training, but every NDA and every data room is different. In doubt, have your own counsel review the wording of your NDA and your DPA.
Ready to put AI to work in deal work itself? See IMs and teasers and Monthly reporting.