Skip to content

Data protection reference  ·  DACH

Popular AI tools: what about data protection?

Compare AI tool tiers for use with personal data, confidential information and professional secrets in Germany, Austria and Switzerland. Choose a criterion, then open an assessment to read its conditions and sources.

Published by kilga.io· AI strategy & governanceCoverage DE · AT (EU GDPR) + CH (revised FADP)Assessment July 2026
Assessment method and legal scope

The assessment covers contractual terms for using personal data, confidential data and professional secrets with AI tools in DACH. It also examines providers’ rights to use your inputs for training and other purposes.

DACH. Germany and Austria fall under the EU GDPR; Switzerland under the revised FADP (nDSG). The “secrets” criterion also considers professional-secrecy rules, including §203 StGB in Germany and Art. 321 StGB in Switzerland. Where international transfers occur, the applicable mechanism and conditions need to be checked for the service and country concerned.

Data location. International transfers depend on the service, endpoint and subprocessors used. Mistral documents EU hosting by default, an optional US endpoint and feature-dependent transfers outside the EU in its data-location guidance. GitHub Copilot’s EU residency controls require GitHub Enterprise Cloud with data residency and an enabled Copilot residency policy, which is off by default. See GitHub’s data-residency requirements.

Footnotes: *For web search, the MCA & DPA do not apply; the Microsoft Services Agreement for private customers applies instead. ** When using Bing Search in Azure, Bing grounding terms also apply; the DPA does not cover that data as customer data.

Compare AI tools

What do you need to check?
Filter by provider
Find a tool
More filters
Highlight a rating
Ratings Meets Measures required Not met Risk decision N/AWEB Web terms riskDEBUG Debug use
Rating definitions and API-key add-ins

Ratings

Minimum requirements generally met. Suitable for the data category in that row, subject to correct configuration.
Risk-based decision required. Open the assessment to read the reservation your organization needs to consider.
Additional measures or restrictions required. The necessary amendments or configuration steps must be in place.
Minimum requirements not met. The tier is unsuitable for this use, or the provider uses your data for its own purposes.
Not applicable. The row’s question doesn’t apply to this offering.

Badges

WEBWith web access, different contractual terms apply or data is used for the provider’s own purposes. This makes the use unsuitable for personal, confidential or secrecy-protected data.
DEBUGWhen accessing the web, data may be used for debugging, so a risk assessment is required.

About “Use via a BYO-key add-in”

These tiers can be used from an Office add-in with your own API key in Word, Excel or Outlook. The add-in connects to your chosen endpoint. Only API-based services qualify; consumer chat apps do not.

On a phone: Scorecard shows one tool at a time. Matrix compares tools side by side and scrolls horizontally.

*For web search, the MCA & DPA do not apply; the Microsoft Services Agreement for private customers applies instead.

** When using Bing Search in Azure, the Terms of Use for Grounding with Bing Search / Grounding with Bing Custom Search also apply. The DPA does not apply and the entered data is not treated as customer data.

This table is published and maintained by kilga.io for information purposes and does not constitute legal advice. Your organization needs to assess its own risks and configure the tools correctly. The assessment considers agreements for customers in DACH: Germany and Austria under the EU GDPR, and Switzerland under the revised FADP. Different agreements may apply in other regions. It covers data protection, not other areas of law such as copyright. Providers change their terms and offers frequently, so check the linked documents before making a decision. The assessment is dated July 2026; terms and DPA links were checked against the providers’ published pages. The data-residency notes for Mistral and GitHub were corrected on 19 October 2026. The comparison covers contractual questions discussed in VISCHER’s published analysis of AI tools, including processing agreements, confidentiality and professional secrecy.

Compare