What it is about
As soon as an AI system handles information about identifiable people — names, emails, customer histories, voice recordings — the GDPR applies. It does not matter whether a human or a machine does the processing.1
The questions to answer
- Legal basis. On what ground may the data be used: contract, consent, legitimate interest?1
- Purpose. Is the AI use covered by the purpose for which the data was collected?
- Where is it processed? Inside the EU, or in a third country such as the USA (then under the EU–US Data Privacy Framework or other safeguards)?3
- Training. Does the provider use your inputs to train its models? Business plans usually allow switching this off.
- Rights. Can you answer requests for access and deletion?
- Impact assessment. High-risk processing needs a data protection impact assessment (Article 35).1
Personal data inside models
The European Data Protection Board stated in December 2024 that an AI model trained on personal data is not automatically anonymous; this has to be assessed case by case.2
In practice
- Use business versions of AI tools with a data processing agreement.
- Keep confidential and personal data out of public tools unless a rule allows it.
- Tell customers when AI processes their data.
- Document decisions — it is the first thing an authority asks for.
Key terms
- Personal data
- Any information about an identified or identifiable person.
- Processor
- A service provider that processes data on your behalf, such as an AI vendor.
- DPIA
- Data protection impact assessment, required for high-risk processing.
Latest research
New papers and reports that mention this term, found by our daily source scan. One line per source, quoted as published.
- theverge.comApple says the feature “largely sidesteps” privacy controls offered to users “to allow backup apps to function properly on Mac.”2026-10-03
- cnil.frLe RGPD prévoit que toute personne ayant subi un dommage matériel ou moral du fait d’une violation du RGPD a le droit d’obtenir réparation auprès du responsable du traitement ou, dans certains cas, du sous-traitant (article 82 du RGPD).2026-10-03
- theverge.comOpenAI’s Dots, by contrast, is restricted for now to users on its $100/month Pro plan and up.2026-10-02