General Data Protection Regulation.

Overview

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European Union's comprehensive data protection framework. Adopted on April 27, 2016 and enforceable from May 25, 2018, GDPR governs the processing of personal data of individuals within the EU and the European Economic Area (EEA).

GDPR is foundational to AI compliance because virtually every AI system that processes information about people involves personal data. GDPR's requirements for lawful processing, data minimization, transparency, and automated decision-making directly shape how AI systems must be designed, trained, and deployed.

Key principles:

1. Lawfulness, fairness, and transparency in data processing
2. Purpose limitation — data collected for specified, explicit, and legitimate purposes
3. Data minimization — adequate, relevant, and limited to what is necessary
4. Accuracy — personal data must be kept accurate and up to date
5. Storage limitation — kept no longer than necessary
6. Integrity and confidentiality — appropriate security measures
7. Accountability — the controller must demonstrate compliance

---

Who It Applies To

Material Scope

GDPR applies to the processing of personal data wholly or partly by automated means, and to non-automated processing of personal data that forms part of a filing system.

Territorial Scope (Article 3)

GDPR applies to:

• Establishments in the EU — any controller or processor with an establishment in the EU, regardless of whether processing takes place in the EU
• Targeting EU residents — controllers or processors outside the EU that offer goods or services to individuals in the EU, or monitor their behavior within the EU

Who Must Comply

---

Key Principles

Article 5 — Principles

1. Lawfulness, fairness, transparency — Processing must have a lawful basis, be fair to the data subject, and be transparent about how data is used.

2. Purpose limitation — Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

3. Data minimization — Only data that is adequate, relevant, and limited to what is necessary for the stated purpose may be collected.

4. Accuracy — Personal data must be accurate and, where necessary, kept up to date. Inaccurate data must be erased or rectified without delay.

5. Storage limitation — Data must be kept in a form that permits identification of data subjects for no longer than necessary for the purposes of processing.

6. Integrity and confidentiality — Data must be processed in a manner that ensures appropriate security, including protection against unauthorized processing, accidental loss, destruction, or damage.

7. Accountability — The controller must be able to demonstrate compliance with all of the above principles.

---

Lawful Bases for Processing

Article 6 establishes six lawful bases for processing personal data:

For AI systems, the most common bases are consent, contract, and legitimate interests. Each has specific requirements and limitations that affect how AI training data is collected and how inference results are used.

---

Data Subject Rights

GDPR establishes comprehensive rights for individuals:

---

AI & Automated Decision-Making

Article 22 — Automated Individual Decision-Making

Article 22 is GDPR's most AI-relevant provision. It provides that individuals have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects or similarly significant effects.

When Article 22 Applies

The prohibition applies when:

• The decision is based solely on automated processing (no meaningful human involvement)
• The decision produces legal effects (e.g., contract denial, employment termination) or similarly significant effects (e.g., credit scoring, insurance pricing, targeted advertising)

Exceptions

Automated decisions are permitted when:

• Necessary for entering into or performing a contract
• Authorized by EU or member state law
• Based on the individual's explicit consent

Even when an exception applies, the controller must implement suitable safeguards, including the right to obtain human intervention, express a point of view, and contest the decision.

Data Protection Impact Assessment (Article 35)

A DPIA is mandatory for:

• Systematic and extensive profiling with significant effects
• Large-scale processing of special category data
• Large-scale systematic monitoring of publicly accessible areas

Most AI deployments that make decisions about individuals trigger the DPIA requirement.

---

Special Categories (Art. 9)

Article 9 imposes heightened protections on special categories of personal data:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (when processed for identification purposes)
• Health data
• Data concerning sex life or sexual orientation

Processing Restrictions

Processing special category data is prohibited unless one of the Article 9(2) exemptions applies:

• Explicit consent
• Employment and social security obligations
• Vital interests
• Legitimate activities of non-profit bodies
• Data manifestly made public
• Legal claims
• Substantial public interest
• Health purposes
• Public health
• Archiving, research, or statistical purposes

AI Implications

AI systems frequently process or infer special category data — for example, facial recognition (biometric data), health prediction models (health data), or sentiment analysis that may reveal political opinions. Organizations must ensure they have a valid Article 9 exemption before using AI to process or derive any of these categories.

---

Penalties & Enforcement

Two-Tier Penalty Structure

Enforcement Authorities

Each EU member state has an independent Data Protection Authority (DPA) responsible for enforcement. The lead supervisory authority is determined by where the controller has its main establishment.

Notable AI-Related Enforcement

---

Compliance Steps

1. Map your data processing activities. Create a Record of Processing Activities (Article 30) covering every AI system that processes personal data — inputs, training data, outputs, and downstream uses.

2. Identify lawful bases. For each AI processing activity, document which Article 6 lawful basis applies. For special category data, identify the applicable Article 9 exemption.

3. Conduct DPIAs for AI systems. Perform Data Protection Impact Assessments for any AI system that profiles individuals, processes special category data at scale, or makes automated decisions with significant effects.

4. Implement transparency. Provide clear privacy notices explaining how AI systems process personal data, including the logic involved in automated decision-making and its significance.

5. Build data subject rights workflows. Implement processes for access requests, erasure requests, and objections that account for data held within AI training sets and model outputs.

6. Review Article 22 compliance. For any AI system making automated decisions with significant effects, ensure meaningful human oversight is in place or that a valid exception and suitable safeguards exist.

7. Establish data processing agreements. Ensure contracts with AI vendors (processors) include Article 28-compliant terms covering data protection obligations, sub-processing, security measures, and audit rights.

8. Appoint a DPO if required. Organizations whose core activities involve large-scale processing of special category data or systematic monitoring must appoint a Data Protection Officer.

---

Frequently Asked Questions

Does GDPR apply to AI systems? Yes. Any AI system processing personal data must comply with GDPR, covering training data, inference inputs, and AI-generated outputs about identified or identifiable individuals.

What is Article 22's impact on AI? Article 22 gives individuals the right not to be subject to solely automated decisions with legal or significant effects — directly applicable to AI-driven hiring, credit scoring, insurance pricing, and benefits determinations.

What are special categories under Article 9? Biometric data, health data, racial or ethnic origin, political opinions, religious beliefs, genetic data, trade union membership, and data concerning sex life or sexual orientation.

Does GDPR apply outside the EU? Yes. GDPR applies to any organization processing EU residents' personal data when offering goods/services to them or monitoring their behavior.

When is a DPIA required for AI? When AI processing is likely to result in high risk — including systematic profiling, large-scale special category processing, or large-scale public monitoring.

How does GDPR interact with the EU AI Act? They are complementary. The EU AI Act regulates AI systems by risk level; GDPR regulates the personal data those systems process. Organizations deploying AI in the EU must comply with both simultaneously.

---

Official Sources

• GDPR full text (EUR-Lex)
• European Data Protection Board (EDPB)
• GDPR info portal