AI and your data, under Monaco law.
Monaco’s data-protection law of 3 December 2024 (Law 1.565), supervised by the APDP, applies to every automation that reads an email, a file or a calendar. This page is how we build so that it does, in plain words. It is practical guidance, not legal advice.
The short version: an automation is a processing operation like any other. It needs a purpose, a legal basis, a record, security, and a known destination for the data. None of that is new; what is new is that an AI tool can quietly send your inbox abroad if nobody checks.
The five questions to ask any AI provider
Where is the data processed, and does it leave Monaco and the European Union? Is any of it used to train a model, and can that be switched off in writing? Who can see it, on your side and theirs? How long is it kept, and can it be deleted? Is there a processing agreement you can show the APDP? If a provider cannot answer all five plainly, that is the answer.
How we build for it
Automations run inside your own accounts, so no copy of your data is created. Models are EU-hosted by default and contractually excluded from training. The automation reads only what the task needs: an inbox agent sees the inbox, not the HR folder. Every action is logged with what was read and why. We hand you a processing record for your register and a short description you can give the APDP or a client who asks.
Special cases
Health data, legal files, financial information and anything about minors need stricter handling and often a prior assessment; we flag these on the quick-check and sometimes say no. Regulated professions also carry their own secrecy and record-keeping duties, which the automation must respect, not bypass. Our client-verification product, Trace, was built around exactly these constraints.
What we do for it.
Data stays in your accounts
No copy, no export, no training. EU-hosted models by default.
A record for your register
Purpose, data, recipients, retention, security: written for you, in the form the APDP expects.
A log you can show
Every action the automation took, with what it read and why. Kept as long as you decide.
Monaco, not just the GDPR
Monaco is not in the EU; its law is its own, close to the GDPR, with the APDP as authority. Transfers to the EU are treated differently from transfers elsewhere, and many AI tools default to servers in the United States. Being established here, we build with that in mind, and we have written about the law in detail on bss.mc.
Questions.
Can we use ChatGPT in the office?
With a business plan that excludes training and with a rule about what may be pasted in, yes. With a personal account and client data, no. We help you write the two-page policy that settles this.
Do we need to tell clients an automation reads their email?
Your privacy notice should describe the processing, as it would for any tool. We give you the paragraph. Where an assistant talks to a client directly, it says so.
Is a data protection impact assessment needed?
For some processing, especially health, profiling or large-scale monitoring. We tell you on the quick-check if yours is likely to need one, and work with your counsel on it.
Do you sign a processing agreement?
Yes, before we see any data. Your template or ours.
Are you lawyers?
No. We build the systems so that they can be defended; your counsel defends them. We are happy to work with yours.
Related.
AI agents in Monaco
An agent is software that can read, decide what to do next within rules you set, use your tools to do it, and ask a person when it should. On this site we usually say assistant or automation, because that is how your team will treat it.
AI automation in Monaco
Enquiries, quotes, follow-ups, reports, checks, bookings. Any task that repeats, built with AI into the tools you already use, with your people deciding. This page explains what that means in practice.
Trace
Trace is client-verification software for Monaco’s regulated professions, built and run by bss works. A person, company or vessel is checked against 18+ official sources, 120,000+ politically exposed persons, 810,000+ offshore entities and the press, in under three minutes, with a dated, fingerprinted PDF report. In production at tracemonaco.com.
Start with a 30-minute call. Keep what it finds.
You tell us where the hours go. We tell you which two or three tasks to automate first, in a short written note. Free, in English or French.