A municipal birth-certificate counter wants a public chatbot to draft cases from real applicant rows that include names, dates of birth, and addresses. What compliance risk should the tester raise?
Select an answer to reveal the explanation.
Short Explanation
GDPR is a seatbelt rule for personal data, not a ban on the whole car. Feeding real names, birth dates, and addresses into a public chatbot without a lawful basis is the problem. GenAI can still be used when data handling stays compliant.
Full Explanation
When testers feed personal data into an LLM, they may process that data under GDPR (Regulation (EU) 2016/679) and need a lawful basis and appropriate controls. The risk is about what is submitted and how it is processed, not a blanket prohibition on GenAI for testing. Prefer anonymized or synthetic data unless governance explicitly allows personal data use.