How does GDPR apply to AI?
GDPR applies to AI as soon as personal data is processed, in questions, in documents the AI reads or in the answers it gives.
The General Data Protection Regulation makes no distinction between AI and other systems. What matters is whether personal data is processed. In an internal assistant it often is, because documents and questions mention people.
The same basic rules apply as for other processing. There must be a legal basis, data must be limited to what is needed and it must be protected. When processing is likely to result in a high risk to the people concerned, an impact assessment is required.
Where the data is processed matters a great deal. If it happens at an external supplier, the supplier becomes a processor. If it happens outside the EU and EEA, rules on transfers apply as well.
How it works
Personal data can appear at several points in an AI workflow. In the documents the AI searches, in the questions asked, in the answers and in the logs. Each point needs a purpose, a legal basis and a plan for how long data is kept.
Data subjects keep their usual rights. They are entitled to know how their data is used, to have it corrected and in some cases erased.
Why it matters
An AI service can carry information into settings where it does not belong. A case once known to one officer can become searchable by many. Thinking data protection through at the start is easier than fixing it later.
What to keep in mind
The accuracy principle applies to AI answers too. If an assistant makes up details about a person, that is inaccurate personal data.
Decisions made solely by automated means that have legal or similarly significant effects on someone fall under special rules. Let a person make the decision.
What it means for you
Find out where your data is processed and who can reach it before you choose an AI service.
Common questions
Can we use AI with personal data?
Yes, if the processing complies with GDPR. You need a legal basis, a clear purpose and protection for the data. The rules are the same with or without AI.
Do we need an impact assessment?
Yes, when the processing is likely to result in a high risk to the people concerned. Using new technology is one of the factors that point that way. Read more about DPIAs.
Can we send personal data to an AI service outside the EU?
Only under certain conditions, such as an adequacy decision or appropriate safeguards. Read more about transfers to third countries.
May the supplier use our data to train models?
A data processor may only process the data on your instructions. If the supplier uses it for its own purposes, it becomes a controller for that processing itself. Check what the contract says.
Sources: Regulation (EU) 2016/679 on EUR-LexEDPB Opinion 28/2024 on AI models
Related terms
Read more
All terms Updated