GDPR for AI

What do you need to know?

1. Every stage of the AI lifecycle needs a lawful basis, and the model itself may hold personal data. Legitimate interest must be earned, and a model is not "anonymous" without proof.
2. Non-compliance costs you mainly through stop, block and retrain orders, not fines. Fines reach EUR 20m or 4% of turnover, yet Italy's EUR 15m OpenAI fine was annulled in March 2026.
3. Only the AI Act side of the Digital Omnibus is law; the GDPR amendments are proposals, not law. AI Act high-risk duties move to 2027-28; GDPR changes are unlikely before 2027.

What should you do now?

1. Document a legitimate-interest assessment for each training dataset. Pair it with notices, a live opt-out before training, and filtering of special-category data. Do not plan around the proposed AI exemptions.
2. Test models before claiming anonymity. Run extraction and membership-inference tests and keep the results. Otherwise treat the model as personal data and plan for rights requests via output filtering and retraining cycles.
3. Map every automated decision against Art. 22 (the GDPR's limits on solely automated decisions), including scores you supply to clients. Build in human review, a route to contest and plain-language explanations, plus a process for trade-secret disclosures to regulators.
4. Run one integrated DPIA (Data Protection Impact Assessment) per AI use case, designed so it can be extended into an AI Act FRIA (fundamental rights impact assessment) ahead of the 2 December 2027 high-risk deadline.
5. Tighten vendor and transfer terms. Use Art. 28 contracts, plus Standard Contractual Clauses and transfer impact assessments for non-adequate countries. Allocate explanation duties contractually. Keep the 72-hour breach clock.

What does the GDPR require when AI uses personal data?

Training needs a legal basis. Collecting, scraping, cleaning and training on personal data is processing. The reference text is Opinion 28/2024 (17 December 2024) of the European Data Protection Board (EDPB), the body of EU data regulators. It covers "development" (pre-release) and "deployment" (live use).

• Consent is rarely workable at web scale, so firms rely on legitimate interest.
• It needs a genuine interest, necessary processing, and individuals' rights not overriding it.
• The EDPB says it is not a default: it must pass that three-step test, weighing people's reasonable expectations.
• Recognised mitigations: pseudonymisation (replacing identifiers so data cannot be linked to a person without extra information), synthetic data, transparency about sources and collection criteria, and an opt-out from the outset.

Courts have accepted this route so far. On 23 May 2025 the Higher Regional Court of Cologne refused to stop Meta training on public EU user data. It accepted legitimate interest, with a right to object and six weeks' notice as safeguards, and reasoning on sensitive ("special-category") data such as health or religion.

That was an interim ruling. Current law still has no general AI exemption for special-category data.

A trained model is not automatically anonymous. It falls outside the GDPR only if the chance of extracting training data is negligible, and of getting it out through queries insignificant. The EDPB judges case by case.

Without extraction and membership-inference testing evidence, assume the model may contain personal data, so data subject rights apply. Where training was unlawful, regulators can order erasure of the dataset or retraining.

Erasure and correction inside model weights remain technically and legally unresolved, with no court or EDPB ruling.

Automated-decision risk is wider than most assume (Art. 22). People may not be subject to solely automated decisions with legal or similarly significant effects, such as credit, hiring or insurance, unless necessary for a contract, authorised by law, or based on explicit consent. Human intervention and a right to contest are required.

• SCHUFA (C-634/21, 7 December 2023): the EU Court of Justice held that a credit agency's automated score is an automated decision when lenders rely heavily on it.
  • The agency must comply, not only the lender, so an AI vendor's scores or recommendations can bring it within Art. 22.
  • How far this extends to AI tools generally is debated.
• Dun & Bradstreet Austria (C-203/22, 27 February 2025): people must get a brief, clear explanation of the procedure and principles actually applied to their data.
  • Handing over a complex formula or the algorithm does not meet that duty.
  • Where trade secrets are claimed, the information goes to the regulator or court, which balances the interests. Blanket refusals are not allowed.

Transfers outside the EU need an adequacy decision or safeguards. In June 2025 Berlin's regulator sought DeepSeek's delisting over unlawful transfers of prompts, files and chat history to China. China has no adequacy decision, and no adequate safeguards were in place.

How is the GDPR enforced against AI, and what does it cost?

Fine tiers (Art. 83), based on total worldwide annual turnover:

The core obligations are enforced. Italy's EUR 5m Replika fine covered lawful basis, transparency, minimisation and privacy by design. Ireland's 2026 Grok inquiry is examining privacy by design and the DPIA.

Fines are slow and fragile. ChatGPT probes opened in 2023 in Spain, Poland, France and Germany had no published final decisions by March 2026. Stop, block and retrain orders are faster and can cost more.

What has changed, and what is only proposed?

The two laws apply side by side. An AI Act FRIA can build on a GDPR DPIA. Joint Commission–EDPB guidance on how they fit together was still pending as of mid-2026.

Adopted: the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026.

• High-risk obligations move to 2 December 2027 for stand-alone (Annex III) systems.
• They move to 2 August 2028 for AI embedded in regulated products (Annex I).
• It clarifies the relationship with the GDPR and tightens conditions for using special-category data to detect bias.

Proposed, not law: the Commission's GDPR amendments (COM(2025) 837, 19 November 2025).

• As of mid-October 2026, EU governments have no agreed negotiating mandate. Planned votes in June, on 7 October and on 11 October were cancelled or postponed.
• Parliament has no committee position; inter-institutional negotiations have not started.
• EU leaders want a deal by end-2026. In practice, changes are unlikely to apply before 2027.

Proposed changes relevant to AI:

• A relative definition of personal data: data would not be personal for an organisation that cannot realistically identify the person. This is the most contested item; regulators strongly oppose it.
• An explicit legitimate-interest basis for AI (new Art. 88c), with an unconditional right to object.
• A derogation for incidental special-category data in AI, with duties to filter it out and remove it.
• Art. 22 recast as a list of permitted cases. Regulators want the prohibition kept.
• Breach notification only for high-risk breaches, within 96 hours.
• EU-wide DPIA lists, and the right to refuse abusive access requests.

What is the GDPR, and how does it apply to AI?

The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU's baseline law for processing personal data, meaning information about an identifiable person. It was adopted in April 2016 and has applied EU-wide since 25 May 2018. The UK runs a near-identical "UK GDPR".

Responsibility follows two roles:

• Controller: decides why and how data is processed, and carries the main liability.
• Processor: acts only on the controller's documented instructions.

Joint controllers must set out their respective duties.

Which dates matter?

Where does this come from?

• EUR-Lex: Regulation (EU) 2016/679 (GDPR)
• CMS: EDPB Opinion 28/2024 key takeaways on AI models
• Freshfields: Cologne court backs Meta's AI training
• Bird & Bird: Key takeaways from the SCHUFA case
• A&O Shearman: CJEU on access rights and trade secrets (Dun & Bradstreet Austria)
• Cross-Border Data Forum: Generative AI and GDPR enforcement in Europe
• Wilson Sonsini: OpenAI prevails in Italian GDPR case