Regulation · EU + UK · Reg. 2016/679
The GDPR
The baseline for personal data. An AI system meets it the moment it uses any, and it runs alongside the AI Act.
- Status
- In force
- Applies since
- 25 May 2018
- UK GDPR
- Since 1 Jan 2021
- Fines
- Up to 4% of global turnover
In brief
Four Duties for Any Use of Personal Data
The GDPR is built on principles, not a checklist. Every processing activity must rest on a lawful basis, honour the data subject's rights, and be something the organisation can demonstrate. For AI, the sharpest edges are training data (which needs a lawful basis like any other processing) and automated decisions.
Article 22 gives a person the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, unless a narrow exception applies with safeguards. Where AI processing is likely to be high-risk, a data protection impact assessment is required before it starts.
- Article 5
- Principles. Lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity.
- Articles 6 & 9
- Lawful basis. Every use needs one of six bases; special-category data needs an Article 9 condition on top.
- Articles 12–22
- Data-subject rights. Access, rectification, erasure, portability, objection, and the Article 22 automated-decision right.
- Articles 5(2) & 35
- Accountability. Demonstrate compliance, and run a DPIA before high-risk processing such as large-scale AI profiling.
Where it meets the others
Where the GDPR Meets the Other Regimes
One fact about a system, and each regime that asks for it.
- One impact assessment
- EU AI Actfundamental-rights impact assessment (Art. 27)may cross-refer to the DPIA (Art. 27(4))
- GDPRdata protection impact assessment (Art. 35)before processing
- One incident
- GDPRnotifies a personal-data breach (Art. 33)72 hours
- EU AI Actreports a serious incident (Art. 73)15 days; 2 days if widespread; 10 days on a death
- NIS2reports a significant incident (Art. 23)24 h warning, 72 h notice, one month
Who owes what
Your Duties Depend on Why You Hold the Data
The GDPR splits responsibility by whether you decide the purpose of the processing or only carry it out for someone else.
- Controller
- You decide the why and how. The primary duty-bearer. Lawful basis, transparency, rights handling, DPIAs, and the accountability to prove all of it.
- Processor
- You process on another's instructions. Act only on documented instructions, secure the data, assist the controller, and carry direct duties for security and sub-processors.
- Joint controllers
- You decide together. Where two organisations jointly set the purpose, they must agree and make transparent who answers for which obligation.
- DPO & EU representative
- The named points of contact. A data protection officer where required (Article 37), and an EU or UK representative for organisations established outside the territory (Article 27).
Timeline
Long Settled, Actively Enforced
Unlike the AI Act, the GDPR is fully in force. The questions now are enforcement and how it interacts with newer AI law.
- Apr 2016
- Regulation 2016/679 adopted, with a two-year run-up to application.
- Adopted
- 25 May 2018
- Applies across the EU; supervisory authorities begin enforcement.
- Live
- 1 Jan 2021
- UK GDPR takes effect post-Brexit, mirroring the EU text with UK-set fines.
- Live
Source: Official Journal of the EU · UK Data Protection Act 2018 and UK GDPR, where reform is ongoing · Check the consolidated text before relying on a date.
Penalties
Two Tiers, Set Against Global Turnover
Fines are the higher of a fixed ceiling or a percentage of worldwide annual turnover. The UK applies equivalent sterling ceilings.
- €20M / 4%
- Breaching the basic principles, lawful basis and consent conditions, data-subject rights, or the rules on international transfers.
- €10M / 2%
- Failing the more procedural duties: records, security measures, breach notification, DPO, or DPIA obligations.
Check the consolidated text before relying on a figure.
The regimes alongside it
The Regimes That Apply Alongside It
- Reg. 2024/1689
EU AI Act
Applies across every sector. Obligations by risk tier for providers and deployers, phasing in to December 2027.
Full guideRead the guide - Dir. 2022/2555
NIS2 Directive
Cyber resilience for essential and important entities. The management body is personally responsible.
In forceRead the guide - Reg. 2022/2554
DORA for financial firms
Operational resilience of the financial system. ICT risk, third-party oversight, resilience testing.
In forceRead the guide
FAQ
Common Questions
It can. Under Article 3, GDPR applies extraterritorially where you offer goods or services to individuals in the EU or monitor their behaviour, regardless of where your organisation is established. Non-EU controllers and processors in scope must also designate an EU representative under Article 27.
Article 83 sets two tiers, each the higher of a fixed sum or a percentage of total worldwide annual turnover: up to EUR 10 million or 2% for lower-tier breaches (such as records or security failings), and up to EUR 20 million or 4% for breaches of core principles, lawful-basis, or data-subject-rights obligations.
A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach (Article 33). Where the breach is likely to result in a high risk to individuals, affected data subjects must also be informed without undue delay (Article 34).
Article 37 requires a DPO where you are a public authority, or where your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special-category or criminal-offence data. Many organisations appoint one voluntarily; some Member States impose wider national requirements.
No. A Data Protection Impact Assessment under Article 35 is required only where processing is likely to result in a high risk to individuals, for example large-scale profiling, systematic monitoring of a public area, or large-scale special-category processing. Supervisory authorities publish lists of operations that always require one.
No, and treating it as the default is a common error. Article 6 provides six lawful bases, including contract, legal obligation, and legitimate interests. Consent is often not the most appropriate basis, and where relied on it must be freely given, specific, informed, and as easy to withdraw as to give.
Article 3 reaches any controller or processor offering goods or services to, or monitoring, people in the EU or UK, wherever it is established. A US model serving EU users is in scope.
Consent is one of six bases and must be freely given, specific, and revocable. A solely automated decision with significant effect needs an Article 22 basis and safeguards, not just consent.
Only truly anonymous data escapes the GDPR. Pseudonymised data, and data that can be re-identified through combination or model memorisation, remains personal data with full duties attached.
Your next step