What is the GDPR and how does it apply to AI?

How it works

What the Regulation is and what it covers

The GDPR is Regulation (EU) 2016/679. As a Regulation rather than a Directive, it applies directly across the EU without needing each country to pass its own transposing law, though member states retain some room to add national rules in specific areas. Its material scope, set in Article 2, covers the processing of personal data wholly or partly by automated means, and non-automated processing of data held in a filing system. It does not apply to truly anonymous data, that is information that does not relate to an identifiable person. It also does not apply to purely personal or household activity, or to areas outside EU law such as national security.

The key building blocks are defined in Article 4. Personal data is any information relating to an identified or identifiable natural person. Processing is almost anything done with that data, from collection to storage to deletion. A controller decides why and how data is processed. A processor acts on the controller's instructions. Pseudonymised data is still personal data. Only genuinely anonymous data falls outside the Regulation.

Territorial scope under Article 3

Article 3 gives the GDPR its long reach. Under the establishment criterion in Article 3(1), the Regulation applies to processing in the context of the activities of an establishment in the EU, regardless of where the processing actually happens. Under the targeting criterion in Article 3(2), it also applies to organisations outside the EU where they process the data of people in the EU in connection with offering goods or services to them, or monitoring their behaviour in the EU. This is why a US-based AI company with no EU office can still fall under the GDPR. The Clearview AI cases turned on exactly this point: the company argued it was outside the GDPR because it had no EU establishment, and European regulators rejected that argument.

The principles in Article 5

Article 5 sets seven principles that govern all processing. Personal data must be processed lawfully, fairly and transparently. It must be collected for specified, explicit and legitimate purposes and not used in incompatible ways, a rule called purpose limitation. It must be adequate, relevant and limited to what is necessary, called data minimisation. It must be accurate and kept up to date. It must not be kept longer than necessary, called storage limitation. It must be kept secure, called integrity and confidentiality. Finally, under the accountability principle in Article 5(2), the controller must be able to demonstrate compliance with all of these. These principles are the backbone of the Regulation, and most enforcement against AI traces back to one or more of them.

Lawful bases in Article 6

To process personal data lawfully you need one of the six lawful bases in Article 6(1): consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest or official authority, or legitimate interests. No single basis is superior, and consent is not the default. For commercial AI training, legitimate interests under Article 6(1)(f) is often the most relevant basis, but it requires a documented three-part assessment, which is explained below. The controller must identify the basis before processing begins and tell people which basis applies.

Data subject rights, Articles 12 to 22

Chapter III gives individuals a set of enforceable rights. Article 12 requires that information and responses be concise, transparent, intelligible and accessible. Articles 13 and 14 require controllers to inform people about processing, whether the data came from them directly or from another source such as web scraping. Article 15 is the right of access, the most exercised and most litigated right. Article 16 is rectification. Article 17 is erasure, the right to be forgotten, which is not absolute and is subject to the exceptions in Article 17(3). Article 18 is restriction. Article 20 is data portability. Article 21 is the right to object. Article 22 covers automated decisions and is discussed below. These rights apply to AI just as they do to any other processing, which raises hard practical questions when personal data is embedded in a trained model.

Lawful basis for AI training data

Training a model on personal data is processing and needs a lawful basis. In Opinion 28/2024, adopted on 17 December 2024 at the request of the Irish Data Protection Commission, the European Data Protection Board confirmed that legitimate interest can be a valid basis for developing and deploying AI models, but only where a three-step test is met. The controller must identify a legitimate interest that is lawful, clearly articulated and real rather than speculative. The controller must show the processing is necessary, meaning there is no less intrusive way to achieve the aim, with attention to data minimisation. And the controller must carry out a balancing test, weighing the interest against the rights, freedoms and reasonable expectations of the people whose data is used. The Opinion stressed that this is a case-by-case analysis. The Italian fine against OpenAI rested in part on a finding that personal data had been used to train ChatGPT without first identifying an adequate legal basis.

Anonymity of models and unlawful training data

Opinion 28/2024 also addressed when a model can be treated as anonymous, and so outside the GDPR. The EDPB set a high bar: both the likelihood of extracting personal data from the model and the likelihood of obtaining it through queries must be insignificant, taking into account all the means reasonably likely to be used. This must be assessed model by model. The Opinion further warned that if a model is developed using unlawfully processed personal data, this can taint later deployment, unless the model has been properly anonymised. In serious cases supervisory authorities can order deletion of training data or even of the model itself, though such steps must be proportionate.

Transparency for AI

Transparency under Articles 12 to 14 requires that people are told, in plain language, how their data is used. For AI this is demanding because models are complex and training data is often scraped from public sources. Where automated decision-making under Article 22 is involved, controllers must also give meaningful information about the logic involved and the significance and envisaged consequences for the individual. The transparency principle in Article 5, and the information duties in Articles 13 and 14, were both cited in enforcement against OpenAI and Clearview AI.

Automated decision-making and profiling, Article 22

Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects. This is often misread as a blanket ban. It is better understood as a prohibition in principle with exceptions: the decision is permitted where it is necessary for a contract, authorised by EU or member state law with safeguards, or based on explicit consent. Where it is permitted, safeguards must include the right to human intervention, to express a view and to contest the decision. In the CJEU judgment of 7 December 2023, Case C-634/21 (SCHUFA Holding, OQ v Land Hessen), the Court held that a credit reference agency generating a probability score is itself carrying out automated individual decision-making within Article 22(1) where a third party draws strongly on that score. In the Dun and Bradstreet case (C-203/22, February 2025), the Court held that controllers must give meaningful information about the procedures and principles behind such decisions, and that trade secrets cannot be used to deny the data subject all explanation.

Special category data, Article 9

Article 9 prohibits processing special category data by default. These categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data about a person's sex life or sexual orientation. Processing is only allowed where an Article 9(2) exception applies, such as explicit consent or substantial public interest. This is a second layer on top of the Article 6 lawful basis, so both must be satisfied. For AI this matters in two ways. First, biometric AI such as facial recognition processes special category data directly, which is why Clearview AI was found to breach Article 9. Second, models can infer special category data, for example health or political views, and inferred sensitive data can fall within Article 9 depending on how deliberate and certain the inference is.

Data protection impact assessments, Article 35

Article 35 requires a data protection impact assessment, or DPIA, where a type of processing is likely to result in a high risk to people's rights and freedoms, particularly when using new technologies. Article 35(3) lists three cases that always require one: systematic and extensive automated evaluation with significant effects, large-scale processing of special category data, and large-scale systematic monitoring of public areas. Much AI falls into these categories. The ICO's list of processing operations likely to result in high risk expressly names AI, machine learning, large-scale profiling and automated decision-making resulting in denial of a service, product or benefit as requiring a DPIA. If a high risk cannot be mitigated, the controller must consult the supervisory authority before proceeding.

Enforcement and fines

The GDPR is enforced by national supervisory authorities, often called data protection authorities, coordinated through the European Data Protection Board. Article 83 sets two tiers of fines. The lower tier reaches 10 million euros or 2 percent of worldwide annual turnover. The higher tier reaches 20 million euros or 4 percent of worldwide annual turnover, for breaches of the core principles, lawful basis, data subject rights and transfer rules. Fines are calculated against several factors and must be effective, proportionate and dissuasive.

How the GDPR interacts with the EU AI Act

The GDPR and the EU AI Act are separate laws that apply at the same time. The AI Act regulates the AI system itself, how it is designed, tested, documented and governed, using a risk-based, product-safety logic. The GDPR regulates what happens to personal data. The AI Act does not replace the GDPR and does not create a new lawful basis for processing personal data, so a valid Article 6 basis is still needed for any personal data used in AI. Where both apply, obligations stack: a fundamental rights impact assessment under the AI Act is meant to complement, not replace, a DPIA under the GDPR. The AI Act's high-risk obligations are being phased in, with key dates around 2 August 2026 and later, subject to ongoing amendments. The detail of the AI Act is covered on its own page.