AI and data protection

The GDPR applies in full

Where an AI system processes personal data — in training data, prompts, outputs or logs — every GDPR principle applies. The European Data Protection Board’s Opinion 28/2024 confirmed that legitimate interests can support the development and deployment of AI models only after a documented three-step test, and that a model trained on personal data is not automatically anonymous. Purpose limitation, minimisation, accuracy and transparency need particular attention, because models can memorise and reproduce data and can produce inaccurate information about people.

What the DPO checks

• Lawful basis and purpose for each AI use, including any reuse of data for training.
• A DPIA where the AI use is likely to be high risk — new technology, profiling and monitoring of staff are common triggers.
• Supplier terms: whether prompts and outputs are retained, used to train models, or transferred outside the EEA.
• Transparency and rights: telling people when AI is used, and handling access, rectification and objection requests that touch AI outputs.
• Article 22 safeguards where decisions are solely automated and significant.

Where the AI Act fits

The AI Act regulates AI systems by risk and by role. Providers place systems on the market; deployers use them under their authority. Some practices have been prohibited since 2 February 2025, including emotion recognition in the workplace and in education (with limited exceptions) and social scoring. Transparency duties under Article 50 apply from 2 August 2026, and high-risk obligations follow on the timetable amended by the 2026 Omnibus. Some deployers of high-risk AI must carry out a fundamental rights impact assessment, which can build on the DPIA. The AI Act does not replace the GDPR: both apply.