Glossary · GDPR
What is the GDPR and how does it affect the use of AI?
Definition: The GDPR is the European Union's General Data Protection Regulation, which governs how organisations collect, use and protect personal data.
Regulation (EU) 2016/679 has applied across the European Union since 25 May 2018. It sets out principles such as lawfulness, purpose limitation, data minimisation, security and accountability, and gives individuals rights such as access, rectification and erasure. In the UK, the UK GDPR and the Data Protection Act 2018 keep largely the same principles, so the points below apply in much the same way.
Using artificial intelligence with personal data is not prohibited, but it means applying those principles. You need to know where the data is processed and whether it leaves the European Economic Area, sign data processing agreements with the processors involved, send the model only the data it needs and check that the provider does not reuse it to train its own models.
Where processing is likely to pose a high risk to individuals, for example when profiling or making automated decisions with significant effects, a data protection impact assessment may be required. The EU AI Act adds its own obligations depending on the risk level of the system. The company's data protection officer or legal adviser should assess each case. This definition is for information only and is not legal advice.
Example: before an AI agent starts classifying customer emails, the company signs a data processing agreement with the model provider, confirms the data is processed within the EU and opts out of its use for training.