GDPR

The General Data Protection Regulation, formally Regulation (EU) 2016/679, establishes requirements for processing personal data. Personal data includes information relating to an identified or identifiable person, such as customer records, device identifiers, location histories, and identifiable conversations with an AI assistant. GDPR can apply to organizations outside the European Union when they offer goods or services to people in the Union or monitor their behavior there. Applicability is not determined solely by citizenship or the location of a cloud server.

Begin an AI initiative by mapping its personal-data flows and purposes. Identify what enters prompts, training datasets, retrieval indexes, model outputs, telemetry, and support systems. Establish an appropriate lawful basis for each processing purpose before processing begins. Consent is one possible basis, not a universal requirement or a shortcut that makes every use lawful. Special-category data, such as health information, requires an additional applicable condition. Reusing customer support records to train a model requires an assessment of purpose compatibility, transparency, and the applicable legal basis rather than assuming the original collection permits training.

Governance must assign accountability. A controller determines the purposes and means of processing; a processor processes personal data on the controller’s behalf. A business commonly acts as controller while a cloud provider acts as processor for customer workloads, but roles depend on the actual processing activity. Review data processing agreements, subprocessors, retention terms, provider use of submitted data, and incident responsibilities. Involve privacy, legal, security, and business owners, and designate a data protection officer where legally required. Maintain processing records and decision evidence where required.

Apply data protection by design and by default. Collect only necessary attributes, restrict access, encrypt data, establish retention schedules, and separate production personal data from development environments. For example, a support assistant can retrieve only records authorized for the current user and redact unnecessary identifiers before sending context to a model. Redaction can reduce model usefulness, while detailed logging improves investigations but creates additional personal-data exposure. Resolve these trade-offs through documented risk assessment and purpose-specific controls. Pseudonymized data remains personal data when individuals can still be identified; encryption is not anonymization.

Conduct a data protection impact assessment before processing that is likely to result in high risks to individuals, including qualifying large-scale profiling or sensitive-data processing. Assess risks such as discriminatory outcomes, unauthorized disclosure, model memorization, and inaccurate inferences. A credit or employment workflow also requires assessment of Article 22 restrictions on solely automated decisions producing legal or similarly significant effects. Exceptions and safeguards are specific; meaningful human involvement is not satisfied by a reviewer who merely approves the model’s answer. GDPR does not prohibit every automated decision or require publication of all model source code.

Operational processes must support applicable rights, including access, rectification, erasure, restriction, objection, and portability. Map requests across source systems, caches, vector stores, logs, and relevant model artifacts. Erasure has exceptions, and deleting a source record does not automatically remove information learned during training. Evaluate whether a model contains personal data and determine appropriate remediation rather than promising that retraining is always required or never necessary.

Cloud-region selection alone does not establish compliance. Evaluate replication, remote access, subprocessors, and international transfers; use an applicable transfer mechanism and assess additional safeguards where needed. Establish breach procedures: a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to risk individuals’ rights and freedoms. Higher-risk breaches can also require notification to affected individuals. For exam scenarios, prioritize accountable governance and risk assessment over claims that encryption, consent, or provider certifications alone establish compliance. GDPR obligations also remain distinct from requirements under AI-specific legislation.