What is the GDPR, and how does it apply to AI?
The GDPR (General Data Protection Regulation) is the European Union’s law on the processing of personal data. It applies to any organization that handles data about people in the EU, wherever the organization is based, and it predates the current wave of AI by several years. It applies to AI because models are trained on data, prompts contain data, and outputs are often decisions about people. Whenever that data identifies a person, the GDPR’s principles and rights apply to the AI system as they would to any other software.
The regulation rests on principles: a lawful basis for every processing purpose, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability. Each one has a specific consequence for AI.
How the GDPR works for AI systems
Training on personal data needs a lawful basis, most often legitimate interest, which requires a documented balancing test, and consent collected for one purpose does not automatically cover model training. Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, unless an exception applies, and even then they can demand human intervention and an explanation of the logic. Article 35 requires a Data Protection Impact Assessment for high-risk processing, which covers most profiling systems. Data subject rights create engineering problems, since a request to erase a person’s data is easy in a database and hard in a trained model. Using a model vendor makes that vendor a processor, which requires a data processing agreement, and sending data to a vendor outside the EU requires a valid transfer mechanism.
The GDPR in practice
A US distributor with a German subsidiary wants to run customer emails through a language model that drafts replies and flags complaints. The subsidiary’s data protection officer identifies the lawful basis as legitimate interest, documents the balancing test, and requires that email content be processed inside the EU. The team chooses a model hosted in a European data center under the company’s control, strips personal identifiers that the reply does not need, and sets a retention period for prompts and outputs. Because no decision with legal effect is automated, Article 22 is not triggered, and the DPIA records that reasoning.
What to watch for
- Check the model vendor’s terms for training on your data, because that is a separate processing purpose needing its own basis.
- Keep a record of where prompts and outputs are stored and for how long, since storage limitation applies to logs too.
- Decide whether any AI output qualifies as a solely automated decision and build the human review route before launch.
- Data residency alone does not make processing lawful, although it removes the transfer question.