General Data Protection Regulation, AI Provisions

Overview

The GDPR entered into force on 24 May 2016 and has applied since 25 May 2018. It is not an AI-specific law, but it can apply when AI involves personal-data processing within Article 3’s territorial scope. Assess establishment, offering goods or services, or monitoring behaviour in the EU as applicable; an individual’s EU citizenship alone is not the scope test.

Article 22 addresses decisions based solely on automated processing that produce legal or similarly significant effects. Identify whether that threshold is met, whether an exception applies and which safeguards are required. Do not infer that every AI-assisted decision is prohibited or gives the same right to human intervention. The information duties in Articles 13 to 15 must be assessed in their own context.

AI processing requires an applicable Article 6 lawful basis. Processing special-category data also needs an Article 9 condition where relevant. Consent and legitimate interests have their own tests; neither is a blanket permission to train a model. Scientific-research safeguards or derogations are not a standalone Article 6 lawful basis. Document the purpose, role and conditions for each processing stage.

Data minimisation (Article 5(1)(c)) presents a fundamental tension with AI development, which often benefits from large datasets. Organisations must ensure they collect only data that is adequate, relevant, and limited to what is necessary for the specified purpose. This impacts AI training data strategies and requires careful justification for dataset scope.

Articles 13 to 15 include information duties concerning covered automated decision-making, including meaningful information about the logic involved and the envisaged consequences where those provisions apply. Provide intelligible information for the affected person; do not promise that publishing a model card alone satisfies every transparency or access obligation.

A DPIA is required before processing likely to create a high risk to people’s rights and freedoms under Article 35. Consider the nature, scope, context and purposes, the listed cases and relevant supervisory-authority criteria. AI use or scale alone is not a substitute for that assessment. Record necessity, proportionality, risks and planned safeguards.

Purpose limitation still applies to training and subsequent use. Article 5 and Article 89 provide specific treatment and safeguards for scientific research and statistical purposes; they do not make all commercial AI training lawful or remove the need for a legal basis. Assess any claimed research purpose and applicable derogation rather than treating an AI project as automatically exempt.

The international transfer provisions (Chapter V) also affect AI systems, particularly cloud-based AI services and models trained on data from multiple jurisdictions. Organisations must ensure adequate safeguards for any transfer of personal data outside the EEA.

Data protection authorities across Europe have been increasingly active in enforcing GDPR against AI systems. Notable enforcement actions have targeted facial recognition companies, AI-driven advertising systems, and automated credit scoring, establishing precedents that shape how organisations must govern AI processing of personal data.