Library
GDPR and AI: Where the Two Actually Overlap
The GDPR is stable. What keeps moving is how the EDPB applies it to models. The overlap that matters in practice is three points: a legal basis for training and inference, purpose limitation when you reuse customer data for a new AI feature, and when an AI system triggers a DPIA.
Last reviewed
MikeFounder & developer
- EU data & privacy
- AI governance
- Compliance
On this page
Who this is for
- Teams adding an AI feature on top of data collected for a different job
- Deployers sending customer or staff personal data to a model endpoint
- People who think the EU AI Act replaced the GDPR (it did not)
The overlap, not the merger
The GDPR (Regulation (EU) 2016/679) and the EU AI Act (Regulation (EU) 2024/1689) run in parallel. The Act says so. A system can be lawful under one and unlawful under the other. The GDPR answers: on what basis, for what purpose, with what risk to people, may you process personal data? The Act answers: may you place or use this AI system at all, and under which tier?
This page is the GDPR side. The Act's dates sit on the timeline.
The GDPR's articles have not been rewritten for AI. The EDPB's reading of those articles has kept moving. Opinion 28/2024 (December 2024) covers anonymity of models, legitimate interest, and unlawfully trained models. Guidelines 03/2026 on web scraping for generative AI were adopted in July 2026. Treat those as current as of 13 August 2026. Treat them as guidance, not as a closed code. Further EDPB work is expected. Do not freeze a 2024 memo and call it done.
Legal basis for training and for inference
Every processing of personal data needs an Article 6 basis. Training and inference are separate processing operations. Each needs its own.
| Operation | What you are doing | Bases that actually get used |
|---|---|---|
| Training / fine-tuning | Using personal data (tickets, emails, CVs, call recordings) to change a model | Legitimate interest (Art. 6(1)(f)) after a documented three-part test; contract (Art. 6(1)(b)) only where the training is strictly necessary for the specific contract with that person; consent (Art. 6(1)(a)) where you can name the person, inform them, and honour a withdrawal |
| Inference | Sending a prompt that includes personal data, or producing an output about a person | Same menu. “The vendor's terms allow it” is not a basis. |
EDPB Opinion 28/2024 accepts that legitimate interest can be a basis for developing or deploying an AI model, subject to purpose, necessity, and a balancing test that is not a rubber stamp. Publicly available data is still personal data. Web scraping for generative training is now the subject of Guidelines 03/2026: legal basis, special-category filters, source reliability, minimisation. If you are not scraping the open web to train a model, those guidelines are background, not your weekly job.
Special-category data (Art. 9) needs an Art. 9 condition as well as an Art. 6 basis. Health notes in a support transcript, union membership, biometric templates: do not train on them because they happened to be in the dump.
A model is not automatically anonymous. Opinion 28/2024: anonymity is a case-by-case test of whether personal data can be extracted from the model or obtained through queries by means reasonably likely to be used. Default assumption for a supervisory authority: you need a thorough evaluation. Document it.
Purpose limitation when you reuse customer data
Article 5(1)(b): collected for specified, explicit and legitimate purposes; not further processed in a manner incompatible with those purposes.
A new AI feature is a new purpose unless you can show compatibility under Article 6(4) (or you go back and get a fresh basis). Compatibility looks at the link to the original purpose, context, nature of the data, consequences, and safeguards.
Lathestone judgement (not the law): turning “we store your tickets to resolve your complaint” into “we fine-tune a model on five years of tickets to draft replies for everyone” is a further purpose. Do the 6(4) analysis or collect for the new purpose. Do not hide it in a privacy-notice update that nobody will read.
Staff data is the same rule with less room. Employment data collected to pay people is not, without more, training data.
When an AI system triggers a DPIA
Article 35: a data protection impact assessment is required where processing is likely to result in a high risk to people. The named case that catches most AI:
- a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person (Art. 35(3)(a)).
Also typical: large-scale special-category data; systematic monitoring of a publicly accessible area.
A DPIA is not a high-risk AI Act file. It is a GDPR document. You may later reuse parts of it in a fundamental-rights impact assessment under AI Act Article 27 (the Omnibus expressly allows cross-reference between a FRIA and a DPIA). Do not skip the DPIA because the Annex III date is 2027.
If the system takes a solely automated significant decision, also read Article 22.
Questions
Does the EU AI Act replace our GDPR file?
No. Recital and operative text of 2024/1689 leave the GDPR in place. You can fail Article 22 and pass Annex III, or the reverse.
Can we rely on legitimate interest to send tickets to a US model vendor?
Possibly for the purpose, never as a substitute for a transfer mechanism. Basis (Art. 6) and transfer (Chapter V GDPR) are different gates. See international transfers.
Is a DPIA always required for a chatbot?
No. A site bot that answers opening hours with no personal data is not Art. 35. A bot that authenticates a customer and changes their account, or that profiles complainants, likely is.
Which EDPB document should we actually open?
Start with Opinion 28/2024. If you scrape the web to train, add Guidelines 03/2026 (July 2026). Both can be superseded. Check the EDPB site when you review this page.
What changed
- 13 August 2026: First publication. Notes Opinion 28/2024 and Guidelines 03/2026. Cadence: stable / evergreen (180–365 days), with an earlier pass if the EDPB issues new AI guidelines. Next review due 13 May 2027.
Note: This is compliance consulting and training, not legal advice. We work alongside your legal counsel, translating regulation into operational reality rather than replacing them. For a structured pass, see AI compliance.
Was this helpful?
Also in the library
- Automated Decision-Making Under GDPR Article 22In the EU, Article 22 GDPR still restricts solely automated decisions with legal or similarly significant effects, with a right to human intervention. ‘Meaningful’ involvement is a person who can change the outcome. A click is not enough. The UK has replaced Article 22 with Articles 22A–22D; that regime is a separate page.
- International Data Transfers for AI & Cloud ToolsThe common case is a UK or EU operator sending personal data to a US-hosted model or SaaS tool. Adequacy (including the EU-US Data Privacy Framework and the UK Extension) is the first gate; if it does not cover that vendor, you need 2021 SCCs and/or the UK IDTA or Addendum, plus a transfer risk assessment.
- The AI Vendor Risk ChecklistA procurement list you can actually use. Data handling, training-on-your-data, sub-processors, audit rights, and model-change notifications: the clauses that decide whether a vendor is safe to put on a live path.