When artificial intelligence is used, the GDPR applies whenever personal data is processed in training, in the input or in the output.
Data protection issues when using AI
Each phase requires a legal basis, which for the training of large models is often legitimate interest. In addition, there are transparency obligations, the need to safeguard data subject rights and appropriate security measures.
Where AI is used to take decisions with significant effects on individuals, the limits on automated individual decisions must be observed. A data protection impact assessment is often required.
Relationship with the EU AI Act
The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. It regulates AI systems according to risk classes, but leaves the GDPR unaffected. Companies must comply with both sets of rules in parallel.
When using external AI services, it must be clarified whether the provider acts as a processor and whether inputs are used for the provider's own purposes, such as training.
Legal provisions
- Art. 6 GDPR
- Legal bases for training and use.
- Art. 22 GDPR
- Automated individual decision-making.
- Art. 35 GDPR
- Data protection impact assessment for new technologies involving a high risk.
- Regulation (EU) 2024/1689
- EU AI Act.
Related terms.
Data protection impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) is a legally required process for assessing and mitigating risks associated with the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), the controller must carry out a DPIA where a planned processing operation is likely to result in a high risk to the rights and freedoms of natural persons. The aim is to identify data protection risks at an early stage and establish appropriate safeguards. Legitimate interest / balancing of interests Legitimate interests constitute a legal basis for the processing of personal data under Article 6(1)(f) GDPR. Companies may process personal data on this basis if the processing is necessary for the purposes of the legitimate interests pursued and those interests are not overridden by the interests or fundamental rights and freedoms of the data subjects. Whether these conditions are met must be assessed as part of a balancing test. Where this legal basis applies, consent is generally not required. Privacy by design Privacy by design means building data protection into the technical and organisational design of systems, products and processes from the outset. Art. 25(1) GDPR 