GDPR

Overview

The General Data Protection Regulation, or GDPR, is the European Union's law on the processing of personal data. Formally Regulation (EU) 2016/679, it sets out when organisations may collect and use information about identifiable people, what they must tell those people, what rights the people have, how data must be protected, and when it may be sent outside the European Economic Area (EEA). It applies directly in every EU member state and, through the EEA Agreement, in Iceland, Liechtenstein and Norway. It has applied since 25 May 2018.

An everyday analogy is the rules for a cloakroom. When you hand over your coat, the attendant may take it only for a stated purpose, must give you a ticket, must keep it safe, must give it back or destroy it when asked, and may not lend it to someone else or ship it abroad without proper safeguards. If the coat is lost through carelessness, the attendant must report it. The GDPR applies that kind of discipline to personal data, which is the coat that people hand over every time they use a service.

The GDPR matters for AI and data teams because most real datasets contain personal data: customer records, support transcripts, logs, images and free text. Training a model, building features, running retrieval over documents or sending prompts to a model provider are all forms of processing. The law does not ban these activities, but it requires a lawful basis, transparency, minimisation, security and respect for people's rights. It also sits alongside the EU AI Act, which adds AI-specific rules without replacing data protection law.

What it is

The GDPR is built on a few main elements.

The controller decides why and how data is processed; the processor processes it on the controller's behalf. A company using a cloud model API to summarise customer emails is typically the controller, and the API provider is often its processor, although roles depend on the facts.

Where it came from

The GDPR replaced the 1995 Data Protection Directive (95/46/EC), which each member state had implemented in its own way. The European Commission proposed the regulation in January 2012. After long negotiations it was adopted on 27 April 2016, published in the Official Journal on 4 May 2016, entered into force 20 days later and has applied since 25 May 2018. It also created the European Data Protection Board, which issues guidelines and resolves disputes between national authorities.

Several later developments shape practice. The Court of Justice's Schrems II judgment of July 2020 invalidated the EU-US Privacy Shield, and the Commission adopted new standard contractual clauses in June 2021. The Commission adopted an adequacy decision for the EU-US Data Privacy Framework in July 2023; in September 2025 the EU General Court dismissed a challenge to it, and the claimant then appealed to the Court of Justice, so its long-term status is not settled. In December 2024 the EDPB adopted Opinion 28/2024 on data protection aspects of AI models, covering when models can be considered anonymous, the use of legitimate interests, and the consequences of unlawful training.

Procedural changes followed. Regulation (EU) 2025/2518, adding harmonised procedural rules for cross-border enforcement, was published in December 2025, entered into force on 1 January 2026 and applies from 2 April 2027. Separately, in November 2025 the Commission proposed targeted amendments to the GDPR as part of a "Digital Omnibus" simplification package, including clarifications on AI development and legitimate interests, pseudonymised data and breach notification. As of November 2026 those amendments are still under negotiation between the Council and the European Parliament and are not law, so the current text continues to apply.

How it works

1. Map the processing

Identify what personal data you hold, where it comes from, why you process it, where it flows and how long you keep it. Record this in a record of processing activities.

2. Choose a lawful basis for each purpose

Each purpose needs one of the six lawful bases. For AI training on customer data, organisations often consider legitimate interests, which requires a three-step test: a legitimate purpose, necessity, and a balancing of interests against the rights of the people concerned. Consent must be freely given, specific, informed and as easy to withdraw as to give.

3. Apply the principles

Collect only what is needed, use it only for compatible purposes, keep it accurate, delete it when no longer needed, and protect it. Pseudonymisation and aggregation help, but pseudonymised data is still personal data for anyone who can re-identify it.

4. Be transparent

Tell people, in clear language, what you do with their data, on what basis, for how long, with whom you share it and what their rights are. Where decisions are made solely by automated means with legal or similarly significant effects, explain the logic involved and offer human intervention.

5. Assess risk

Run a DPIA before high-risk processing, such as large-scale profiling, new technologies like many AI systems, or systematic monitoring. Document risks and mitigations, and consult the supervisory authority if high risk remains.

6. Contract and transfer carefully

Sign processor agreements with vendors, including model and cloud providers. For transfers outside the EEA, rely on an adequacy decision or put safeguards such as standard contractual clauses in place, with a transfer impact assessment where needed.

7. Secure and respond

Use appropriate security measures. Detect and handle breaches, notifying the authority within 72 hours where feasible. Answer rights requests within one month, extendable by two further months for complex cases.

8. Demonstrate accountability

Keep evidence: policies, records, DPIAs, training, contracts and logs. Appoint a data protection officer where required, for example for large-scale monitoring or large-scale special-category processing.

Key concepts and terms

A worked example

This scenario is illustrative. A European online retailer wants to fine-tune a language model on 400,000 historical customer-support conversations to draft replies for agents. The conversations include names, addresses, order numbers and sometimes health information, for example customers explaining why they returned a mobility aid.

The privacy team runs a DPIA. They choose legitimate interests as the lawful basis, documenting the purpose (faster, more consistent support), necessity (the model needs real conversation patterns) and balancing (customers would reasonably expect support data to improve support, but not to be exposed). Health information is special category data, and no Article 9 exception clearly applies to this purpose, so they remove it.

The data engineering team builds a pipeline using a PII detection tool such as Presidio to replace names, emails, phone numbers and addresses with placeholders, and a classifier to drop conversations mentioning health. Around 6% of conversations are excluded. Retention is limited to 24 months of history. The privacy notice is updated to describe the use, and customers are offered a simple way to object; objections are honoured by removing their conversations from future training runs.

The model is hosted in an EU region under a processor agreement. Outputs are tested for memorised personal data with targeted prompts before deployment. Agents review every drafted reply, so no decision is solely automated. The DPIA, test results and data lineage are stored as accountability evidence, linked to the model's model card.

Strengths and limitations

Strengths:

• One harmonised framework across the EEA, with strong individual rights.
• Principle-based, so it applies to new technologies such as AI.
• Clear duties for security, breach notification and accountability.
• Influential worldwide; many other laws follow its structure.
• Significant penalties give it practical force.

Limitations:

• Principles require interpretation; guidance on AI training is still developing.
• Compliance can be costly for small organisations.
• Enforcement varies between authorities and cross-border cases have been slow, which the new procedural regulation aims to address.
• Rights such as erasure are hard to apply to trained models.
• International transfer rules remain complex and subject to legal challenge.

How it compares with alternatives

Practical guidance and best practices

1. Map datasets used for analytics and AI, including logs, prompts and embeddings, in your record of processing.
2. Choose and document a lawful basis for each purpose before collecting or reusing data.
3. Run DPIAs early for AI projects using personal data, and update them when the system changes.
4. Minimise and pseudonymise data in pipelines; remove special category data unless an exception clearly applies.
5. Sign processor agreements with model, cloud and labelling vendors, and check where data is processed.
6. Design for rights requests: trace which datasets and models a person's data entered.
7. Test models for memorisation and leakage of personal data before release.
8. Keep humans meaningfully involved in decisions with significant effects on people.
9. Track pending changes, such as the Digital Omnibus proposals, but comply with the law as it currently stands.

Common mistakes

• Assuming publicly available data is free to use for any purpose.
• Treating pseudonymised data as anonymous.
• Relying on consent buried in terms and conditions.
• Sending personal data to model APIs outside the EEA without transfer safeguards.
• Keeping training snapshots and logs indefinitely.
• Forgetting that embeddings, vector indexes and prompt logs can contain personal data.
• Treating proposed amendments as if they were already in force.

Frequently asked questions

Does the GDPR apply to companies outside the EU?

Yes, when they offer goods or services to people in the EU or monitor their behaviour there, under Article 3(2). Such companies usually need to appoint a representative in the EU.

Can I train an AI model on personal data?

It can be lawful, but it needs a lawful basis, transparency, minimisation, security and respect for rights. The EDPB's Opinion 28/2024 discusses legitimate interests and when a model may be considered anonymous; each case needs its own assessment.

What are the maximum fines?

Up to 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher, for the most serious infringements, and up to 10 million euros or 2% for others.

How quickly must a data breach be reported?

To the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. Affected individuals must be told without undue delay when the risk is high.

Is the GDPR being changed?

The Commission proposed targeted amendments in November 2025 as part of the Digital Omnibus. As of November 2026 they are still being negotiated and are not law. A separate procedural regulation, 2025/2518, will apply from 2 April 2027 to cross-border enforcement.

How does the GDPR relate to the EU AI Act?

They apply together. The AI Act sets requirements for AI systems by risk level; the GDPR governs any personal data those systems process.

Glossary

• GDPR: General Data Protection Regulation, Regulation (EU) 2016/679.
• EEA: European Economic Area, the EU plus Iceland, Liechtenstein and Norway.
• Data subject: the person the data is about.
• Controller: decides why and how data is processed.
• Processor: processes data for a controller.
• EDPB: European Data Protection Board.
• DPO: data protection officer.
• DPIA: data protection impact assessment.
• SCCs: standard contractual clauses for international transfers.
• Adequacy: recognition that a country's protection is essentially equivalent.

Summary

The GDPR, applying since 25 May 2018, governs how personal data of people in the EU and EEA is processed. It requires a lawful basis, transparency, minimisation, security, respect for rights, care with international transfers and demonstrable accountability, with fines of up to 4% of worldwide turnover. For AI teams it shapes how training data is chosen, cleaned and documented, how vendors are contracted and how models are tested and governed. A procedural regulation will apply from April 2027, and amendment proposals from November 2025 are still under negotiation, so teams should follow the current text while tracking changes. This page is general information, not legal advice.

Related

It belongs to Security and governance in my stack, under MLOps and AI infrastructure. Others in the same group: