GDPR and AI: How to Comply When AI Processes Personal Data
TL;DR — GDPR applies whenever your AI processes personal data of EU residents, regardless of AI Act classification. The two regulations stack — compliance with one does not exempt from the other. Six requirements: identify a legal basis, conduct a DPIA, ensure human oversight under Article 22, minimize data before sending to LLMs, sign a DPA with model providers, and inform individuals about AI use. Fines accumulate: GDPR up to EUR 20M or 4% of turnover, AI Act up to EUR 35M or 7%.
GDPR and the EU AI Act are two separate regulations that apply simultaneously to AI systems processing personal data. The AI Act explicitly states it does not affect GDPR application (Article 2(7)). Both apply. Both can fine you. They do not satisfy each other.
For enterprises, this means parallel compliance tracks. GDPR governs how personal data is processed. The EU AI Act governs how AI systems are classified, deployed, and monitored. When your AI processes personal data — which most enterprise AI does — both frameworks apply, and both sets of obligations must be met.
How GDPR Applies to AI Systems
GDPR applies to any processing of personal data of EU residents, regardless of where the processing occurs. An AI system processes personal data when it:
- Trains on datasets containing personal data (names, emails, customer records)
- Receives personal data in prompts or inputs (employee records, customer PII)
- Generates outputs that include personal data (names, addresses, identifiers)
- Makes decisions about individuals (credit scoring, hiring, insurance pricing)
The CNIL (France's data protection authority) published AI-specific GDPR recommendations in 2024, updated in 2026, confirming that AI development and deployment involving personal data require a legal basis, data minimization, transparency, and security measures (CNIL 2026).
The seven GDPR principles applied to AI
| GDPR principle | What it means for AI |
|---|---|
| Lawfulness, fairness, transparency | Identify a legal basis before processing. Inform individuals about AI use. |
| Purpose limitation | Training data collected for one purpose cannot be reused for AI training without a compatible purpose. |
| Data minimization | Do not send personal data to an LLM if pseudonymized or aggregated data suffices. |
| Accuracy | Training data must be accurate. Model outputs containing personal data must be correctable. |
| Storage limitation | Define retention periods for training data and model outputs. Personal data cannot be kept indefinitely. |
| Integrity and confidentiality | Implement access controls, encryption, and security measures for AI infrastructure. |
| Accountability | Document compliance. Maintain records of processing activities for each AI use case. |
GDPR Article 22: Automated Decision-Making and AI
Article 22 gives individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. This is the GDPR provision most directly relevant to AI.
AI systems that make or significantly influence decisions about people — hiring, credit, insurance, benefits eligibility — trigger Article 22. Three exceptions allow automated decision-making:
- Contractual necessity: The decision is necessary for entering into or performing a contract (e.g., credit scoring for a loan)
- Explicit consent: The individual has explicitly consented to the automated decision
- Legal authorization: EU or Member State law authorizes the decision (e.g., tax fraud detection)
Even when an exception applies, the individual has the right to:
- Obtain human intervention
- Express their point of view
- Contest the decision
For AI systems, this means you cannot fully automate decisions with legal effects without providing a human review pathway. The AI agent approval gates pattern directly addresses this requirement — a human must be able to override or reverse the AI's decision.
GDPR Article 35: DPIA Requirements for AI
A Data Protection Impact Assessment is mandatory before deploying any AI system likely to result in high risk to individuals' rights. Article 35(3) lists three automatic triggers:
- Systematic and extensive profiling producing legal or similarly significant effects (AI-based hiring, credit scoring)
- Large-scale processing of special category data (health, biometric, genetic data in AI training)
- Systematic monitoring of publicly accessible areas on a large scale (AI-powered surveillance)
The EDPB identifies nine criteria that indicate high risk. If your AI system meets two or more, a DPIA is required:
| EDPB criterion | AI example |
|---|---|
| Evaluation or scoring | AI profiling job candidates |
| Automated decision-making with legal effect | AI determining loan eligibility |
| Systematic monitoring | AI tracking employee behavior |
| Sensitive or highly personal data | AI processing health records |
| Large-scale processing | AI training on millions of customer records |
| Matching or combining datasets | AI merging CRM and HR data |
| Data concerning vulnerable persons | AI processing children's or patients' data |
| Innovative use of new technology | First deployment of a new AI capability |
| Preventing exercise of a right | AI that blocks access to services |
Most production AI systems processing personal data meet at least two criteria. The practical rule: if your AI touches personal data, plan for a DPIA.
DPIA vs FRIA: What's the difference?
The EU AI Act adds the Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems. FRIA and DPIA overlap but are not identical:
| Aspect | GDPR DPIA | AI Act FRIA |
|---|---|---|
| Legal basis | GDPR Article 35 | AI Act Article 27 |
| Scope | Data protection risks | Fundamental rights (broader) |
| When required | High-risk processing of personal data | High-risk AI deployed by public bodies |
| Can be combined? | Yes — Article 27(4) says FRIA complements DPIA | Yes — share data flows, risk catalog, mitigations |
The pragmatic approach in 2026: combine DPIA + FRIA into a single document with shared sections (data flows, risk catalog, mitigations) and AI-Act-specific addenda (intended use, foreseeable misuse, human oversight, bias testing). This saves weeks per assessment (Strac 2026).
Legal Bases for AI Processing Under GDPR
Before deploying any AI system that processes personal data, you must identify a legal basis from GDPR Article 6:
| Legal basis | When it works for AI | Requirements |
|---|---|---|
| Consent | User explicitly agrees to AI processing | Must be freely given, specific, informed, withdrawable |
| Contractual necessity | AI processing needed to deliver a service the user requested | Decision must be necessary for contract performance |
| Legal obligation | Law requires the AI processing | Cite the specific legal obligation |
| Vital interests | AI processing protects someone's life | Rare in enterprise AI |
| Public task | Public authority performing a function | Must be in the public interest |
| Legitimate interests | AI processing benefits the organization and does not override individual rights | Requires a balancing test (LIA) |
Legitimate interest is the most common basis for internal enterprise AI, but it requires a Legitimate Interests Assessment (LIA) documenting:
- The legitimate interest pursued
- The necessity of the processing
- The impact on individuals' rights
- Safeguards to mitigate the impact
Data Minimization and PII Redaction for AI
GDPR's data minimization principle requires that personal data be "adequate, relevant and limited to what is necessary." For AI, this means:
- Pseudonymize before sending: Remove or replace names, identifiers, and contacts before sending text to an LLM. The CNIL recommends that "good AI doesn't need to know who is concerned to draft a summary" (CNIL 2026).
- Aggregate where possible: Use aggregated or anonymized data for training instead of raw personal data.
- Limit prompt content: Do not include unnecessary personal data in prompts. Preventing sensitive data from leaking into AI prompts is both a security and a GDPR requirement.
For a deeper technical guide, see PII redaction before AI ingestion.
DPA Requirements With AI Model Providers
If you send personal data to an external LLM API (OpenAI, Anthropic, Google), the provider is a data processor under GDPR Article 4(8). Article 28 requires a signed Data Processing Agreement before any processing occurs.
A compliant DPA with an AI provider must cover:
- Processing purpose and duration
- Data retention and deletion policies
- Sub-processor disclosure and approval
- Data transfer mechanisms (if data leaves the EU)
- Audit cooperation rights
- Breach notification obligations
- Return or deletion of data on termination
Terms of service are not a substitute for a DPA. Most major providers offer standard DPAs for enterprise customers — but you must verify sub-processor lists, data residency, and whether the provider can satisfy Article 17 (right to erasure) for training data they may hold.
Self-hosting your AI platform eliminates this requirement entirely. When the model runs on your infrastructure, there is no external data processor. See self-hosted AI vs SaaS security for the architectural comparison.
Transparency Obligations for AI
GDPR Articles 13 and 14 require informing individuals about automated processing. For AI systems, this means your privacy policy must disclose:
- That AI is used to process personal data
- The logic involved in the processing
- The consequences for the individual
- The right to human intervention (if Article 22 applies)
The "black box" argument is not a defense. You must provide meaningful information about the AI system's logic — not the full technical detail, but enough for individuals to understand how decisions about them are made.
GDPR and AI Act: Cumulative Compliance
| Aspect | GDPR | EU AI Act |
|---|---|---|
| Scope | Personal data of EU residents | AI systems used in the EU |
| Max fine | EUR 20M or 4% of global turnover | EUR 35M or 7% of global turnover |
| Key requirement | Legal basis, DPIA, data minimization | Risk classification, conformity assessment |
| Overlap | Both require human oversight, transparency, documentation | Both apply simultaneously |
| Can one satisfy the other? | No | No |
The two frameworks are not aligned and do not satisfy each other. GDPR compliance does not satisfy AI Act conformity assessment, logging, or transparency requirements. Meeting the AI Act does not replace GDPR lawful basis documentation or DPIAs. Both apply simultaneously to AI systems processing personal data (BeyondScale 2026).
FAQ
Does GDPR apply to AI systems?
Yes. GDPR applies whenever an AI system processes personal data of EU residents, regardless of the AI Act risk classification. The AI Act does not replace GDPR — both apply simultaneously. Compliance with one does not exempt from the other.
What is GDPR Article 22 and how does it affect AI?
GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. AI systems making hiring, credit, or insurance decisions must have human oversight, explicit consent, or contractual necessity as a lawful basis.
When is a DPIA required for AI systems?
A DPIA is mandatory under GDPR Article 35 when AI processing is likely to result in high risk. Three automatic triggers: automated decision-making with legal effects, large-scale special category data, and systematic monitoring. Most AI systems processing personal data meet at least two EDPB criteria, making a DPIA effectively mandatory.
What legal basis do you need for AI processing under GDPR?
You need one of six GDPR legal bases before deploying AI: consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. The choice depends on the use case. Legitimate interest is common for internal AI tools but requires a balancing test.
Do you need a DPA with your AI model provider?
Yes. Under GDPR Article 28, if personal data is sent to an external LLM API (OpenAI, Anthropic, Google), the provider is a data processor. You need a signed Data Processing Agreement before any processing occurs. Terms of service are not a substitute.
Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →