GDPR and AI data
GDPR governs any AI that processes personal data of EU residents. You need a lawful basis, must honor data-subject rights, and face limits on solely automated decisions, enforced by fines up to 20M euros or 4% of global turnover.
Lawful basis and automated decisions
You must have a lawful basis to feed personal data into AI, and GDPR restricts decisions made solely by automation with legal or similar effects, giving individuals a right to human review and explanation.
GDPR Article 22 limits solely automated decisions that significantly affect people, requiring safeguards including human intervention and the ability to contest the outcome. Training AI on personal data needs a lawful basis and a data-protection assessment for high-risk processing. Because GDPR and the EU AI Act both apply to the same systems, treating them as one combined program, one data inventory, one set of controls, is far more efficient than running two.
Frequently asked questions.
Can we train AI on customer data under GDPR?
Only with a valid lawful basis and appropriate safeguards. High-risk processing requires a data-protection impact assessment, and you must respect data-subject rights including access, objection, and, for significant automated decisions, human review.