The GDPR applies to AI whenever personal data is used to train, run or test an AI system, or when AI makes decisions about people. A developer needs a lawful basis such as consent or legitimate interest, and the European Data Protection Board says legitimate interest must pass a three-step test. People keep rights, including a right not to face purely automated decisions with significant effects.
01When does the GDPR apply to an AI system?
The GDPR covers any handling of personal data, which means information about an identifiable person. AI touches it in several places: the data collected to train a model, the prompts people type, outputs about real people, and decisions made about individuals.
In Opinion 28/2024, adopted on 17 December 2024 at the request of the Irish regulator, the European Data Protection Board (EDPB) said a model trained on personal data cannot always be called anonymous. Regulators judge each claim case by case. For a model to count as anonymous, the chance of pulling out personal data directly, or getting it through queries, must be insignificant.
This page is general information, not legal advice. For a real project, ask a data protection lawyer or your national regulator.
02Which lawful basis can an AI developer use?
Article 6(1) offers six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. For large training sets, consent is often hard to collect, so developers often look at legitimate interests.
The EDPB opinion repeats a three-step test for that basis: name a real and lawful interest, show the processing is necessary for it, and show that people's rights do not outweigh it. It says no legal basis ranks above another, that people's reasonable expectations matter, and that safeguards can help tip the balance. France's regulator, the CNIL, published recommendations on 7 June 2024 that walk developers through purpose, roles, legal basis and impact assessments.
The opinion also asks what follows if a model was built unlawfully. Its general answer is that regulators have discretion and should pick measures that are appropriate, necessary and proportionate in each case.
Article 35 requires a data protection impact assessment before processing that is likely to create a high risk to people's rights, especially with new technologies.
03What do the rules say about automated decisions?
Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, if it has legal effects or similarly significant effects on them. There are three exceptions: the decision is needed for a contract, it is authorised by law with safeguards, or the person gave explicit consent. In the contract and consent cases the controller must offer at least a right to human intervention.
The Court of Justice widened the picture in the SCHUFA ruling of 7 December 2023. It held that a credit agency's automated score counts as an automated decision when a third party, such as a bank, draws strongly on that score to start, run or end a contract.
People can also ask what is going on. Article 15(1)(h) gives a right to meaningful information about the logic involved in automated decisions, and what it means for them.
04What have regulators done about AI and personal data?
Regulators have published guidance and some have acted against specific services. One case shows how unsettled this is. The Italian regulator, the Garante, adopted decision no. 755 of 2 November 2024 about ChatGPT. Its own page says the decision was temporarily taken offline after the Rome Tribunal published judgment no. 4153/2026 on 18 March 2026, which upheld the appeal against it. The page does not give the court's reasons, so we do not report them.
Under Article 83(5), breaking the core principles or people's rights can bring fines of up to EUR 20 million or 4 percent of worldwide yearly turnover, whichever is higher.
05How does the AI Act connect to the GDPR?
Both laws can apply at once. The 2026 amendment to the AI Act, Regulation (EU) 2026/1744, explains that a new Article 4a is meant to give providers and deployers a legal basis to process sensitive data to detect and correct bias, under strict safeguards.
A separate proposal would change the GDPR itself. The Parliament's procedure page listed it as awaiting a committee decision, with a committee draft report dated 22 June 2026. Nothing in it is law.
?What is not known
- Whether and how the GDPR will be changed for AI. The proposal is still in the Parliament and its text can change.
- How courts will treat national regulator decisions on AI. The Italian case shows a decision can be set aside on appeal, and we did not confirm the court's reasons.
- How the EDPB's tests apply to each new model. Regulators say they decide case by case.
QQuestions people ask
Is training an AI model on public web data allowed under the GDPR?
The GDPR still applies to personal data found on public pages. The EDPB says the developer needs a valid legal basis, and the three-step legitimate interest test looks at what people could reasonably expect, among other points.
Do I have a right to a human review of an AI decision?
Where Article 22 applies and the decision rests on a contract or your consent, the organisation must offer at least human intervention. The rule covers decisions with legal or similarly significant effects.
Last checked October 24, 2026. Rules and settings change, so open the source to see the current version.
- General Data Protection Regulation (EU) 2016/679 EUR-Lex, Publications Office of the European Union The law text; used for Articles 6, 15, 22, 35 and 83.
- EDPB Opinion 28/2024 on AI models European Data Protection Board The Board's opinion on anonymity and legitimate interest.
- Judgment in Case C-634/21, SCHUFA Holding (Scoring) Court of Justice of the European Union, via EUR-Lex The 2023 ruling on credit scores as automated decisions.
- CNIL first recommendations on developing AI systems CNIL (France) The French regulator's June 2024 recommendations.
- Garante page on decision no. 755 of 2024 Garante per la protezione dei dati personali (Italy) Shows the decision's status after the Rome Tribunal judgment.
- Regulation (EU) 2026/1744 EUR-Lex, Publications Office of the European Union The 2026 AI Act amendment, including the Article 4a recital.
- Digital Omnibus procedure 2025/0360(COD) European Parliament, Legislative Observatory Stage of the proposed GDPR changes.
General information, not legal, medical, financial or investment advice. We are not affiliated with any company, agency or standards body named here. See our editorial policy and corrections, or tell us about a mistake at [email protected].