Short answer: when you share a dashboard built in Claude, ChatGPT or Lovable, your data usually ends up outside your own systems, and often outside the EU. Claude stores data in the US by default and has no EU residency option on claude.ai. ChatGPT offers EU storage, but only for new Enterprise and Edu workspaces. Lovable keeps AI requests in the EU only on its Enterprise plan.
GDPR does not forbid any of this. It does mean you need a legal basis, a data processing agreement and a transfer mechanism for every place the data lands. The safest setup keeps the data where it already lives, in your own data platform, and lets the dashboard query it under each viewer's own rights.
- The risk is not the chart, it is the data copied into it: extracts, uploaded files and snapshots.
- Check three things per tool: where data is stored, where it is processed, and who can open the link.
- Personal data in a dashboard shared with "anyone with the link" is a data breach waiting to happen.
- A live dashboard on your own semantic model, with row-level security, avoids most of the copying.
Where your data travels when you share an AI dashboard
An AI-built dashboard touches your data in up to four places. Each one is a separate GDPR question.
- The prompt and the conversation. Everything you paste or upload while building goes to the AI provider and is stored in your chat history.
- The model inference. The AI provider processes the data on its servers, sometimes in a different region than where it stores it.
- The dashboard's own data. Some dashboards hold a copy of the data: an extract, an uploaded CSV, or numbers baked into the HTML. Others run a live query each time someone opens them.
- The viewer's screen. Everyone who opens the link sees whatever the dashboard holds, unless access is filtered per person.
The first two are about your AI provider. The last two are about how you share. Most leaks happen at step 3 and 4: a snapshot with customer names, shared more widely than intended.
Live queries are the exception. When a dashboard queries your data platform under the viewer's own identity, nothing is copied into the dashboard and each person sees only their own rows. We explained this for Claude in Rolling out Claude dashboards safely.
Data residency per tool
Only some plans of some tools keep data in the EU. Status as of November 2026:
Two things stand out. First, "EU option" almost always means an enterprise contract, not the plan most teams build on. Second, residency of the AI conversation says nothing about the dashboard you publish afterwards. A Lovable app or a Claude extract has its own storage location.
A data processing agreement with Standard Contractual Clauses makes a US transfer lawful under GDPR. It does not make it EU-only. For finance, healthcare or public-sector clients, that difference often decides the matter.
The hidden GDPR risk: copies, links and personal data
The biggest GDPR risk is not where the AI runs. It is a dashboard that holds personal data and is open to more people than it should be.
This already happens at scale. In October 2025, UpGuard found over 10,000 self-hosted Streamlit apps open without login, including a CRM with contacts at 617 companies and a debt collection tool listing people by name. In May 2026, Red Access found about 5,000 publicly reachable AI-generated web apps leaking data such as medical records and financial files, as reported by eWeek.
Three patterns cause most of it:
- Snapshots with personal data. An extract or uploaded file sits inside the dashboard. Row-level security does not apply to it, so every viewer can read every row.
- "Anyone with the link". Links get forwarded. Once a dashboard with customer or employee data is reachable without login, an accidental leak can become a reportable breach.
- No end date. A prototype built for one meeting stays online for months, with data nobody refreshes or deletes. That conflicts with GDPR's storage limitation principle.
Under GDPR, a personal data breach must be reported to the supervisory authority within 72 hours. In the Netherlands that is the Autoriteit Persoonsgegevens.
GDPR checklist before you share an AI dashboard
Run through this list before a dashboard leaves your team.
- Does it contain personal data? Names, emails, employee IDs, customer numbers. If not needed, aggregate them away.
- Is the data copied or live? Prefer live queries on your own data platform over extracts and uploaded files.
- Where is it stored and processed? Check the AI tool's region and the hosting of the published dashboard separately.
- Is there a DPA with each provider? Include the AI provider and the hosting platform. Check their sub-processor lists.
- Is there a transfer mechanism for non-EU processing? Usually Standard Contractual Clauses; record it in your processing register.
- Who can open it? Named people with a login, never "anyone with the link" for personal data.
- Does each viewer see only their own rows? Row-level security, per client or per department.
- Can you see who opened it? An access log helps you answer a breach or access request.
- When does it expire? Set an owner and a review or delete date.
- Have you done a DPIA if needed? Required for large-scale or sensitive personal data, such as health or financial data.
How DataTako keeps the data in your own Microsoft tenant
With DataTako, the AI builds the dashboard, but the data never moves into it. Data dashboards query your Power BI semantic model directly every time someone opens them. There are no exports, extracts or copies.
- Data stays in your tenant. Datasets and source data remain in your Microsoft tenant. DataTako acts as a conduit to Power BI Embedded and does not store the underlying data (security & privacy).
- Hosted in Europe. The DataTako portal and its services run on EU infrastructure.
- Row-level security on every load. Each viewer sees only the rows their RLS role allows, including external clients.
- Named logins, no public links. Viewers sign in on your own domain, with email and password or SSO. They need no AI account and no Power BI licence.
- Drafts stay private. Nothing goes live until you publish it, and you can preview a draft as a specific RLS role first.
- Limited storage on the AI side. The AI apps activity log records who used what, not questions or results. Large query results are held for paging for at most one hour.
One honest caveat: while you build, the conversation still runs through your own AI provider (Claude, ChatGPT or another app) under your agreement with them. Check that agreement as described above. The published dashboard itself holds no data copy.
FAQ
Is Claude GDPR compliant for dashboards? Claude's commercial plans include a DPA with Standard Contractual Clauses, so using it can be lawful. But claude.ai stores data in the US by default and has no EU residency option. Whether that is acceptable depends on your data and your clients.
Does ChatGPT keep my dashboard data in the EU? Only on new Enterprise, Edu and Healthcare workspaces with EU residency enabled. Business and Plus plans store data in the US.
Can I share an AI dashboard that contains customer names? Yes, if only people with a legitimate need can see them. Use named logins and row-level security, never a public link.
Is a live query safer than an extract? Usually yes. A live query reads data under the viewer's own rights and leaves no copy in the dashboard. An extract is readable by everyone who can open it.
Do I need a DPIA for an AI dashboard? Only when processing is high-risk, such as large-scale health, financial or employee monitoring data. When in doubt, ask your privacy officer.
Can external clients see AI dashboards without a Claude or ChatGPT account? Not inside those tools. In a DataTako portal they sign in on your domain and see only their own data.
Conclusion
GDPR does not stop you from sharing AI dashboards. Copies of personal data in the wrong place do. Keep the data in your own platform, give every viewer a named login and row-level security, and know where each tool stores what. See how DataTako data dashboards work.
