AI Vocabulary · 08 Rules & Responsibility
What is GDPR?
The EU's data protection law. It applies whenever AI tools process personal data about people in the EU.
The General Data Protection Regulation (Regulation (EU) 2016/679) governs how personal data, meaning any information about an identifiable person, may be collected and used. It applies to organisations in the EU and to those outside the EU that process data about people in the EU.
Using AI doesn't create an exception. If you paste customer emails, CVs, chat logs or meeting recordings into an AI tool, that is processing personal data. Core principles still apply: a lawful basis, a clear purpose, using only the data you need, security, transparency towards the people concerned and respecting their rights. Using a provider usually requires a data processing agreement, and transfers outside the EU need extra safeguards. The GDPR also limits decisions about people based solely on automated processing.
The EU AI Act adds AI-specific rules on top; it does not replace the GDPR.
Why it matters for you
Most everyday AI risks in small companies are data protection risks: personal data in the wrong tool, no agreement with the provider, no information for customers. They are also the easiest to fix.
Own it
Before using AI with personal data, ask: do we really need personal data for this, or can we remove names first? Is there a DPA? Where is it processed? Is training on our data excluded? Involve your data protection officer or advisor for anything sensitive. This entry is an overview, not legal advice.
Where it comes from
The General Data Protection Regulation, Regulation (EU) 2016/679, was adopted in April 2016 and has applied since 25 May 2018. It replaced a 1995 directive written before social media and smartphones. Its reach beyond Europe, applying to anyone handling EU residents' data, made it a model for privacy laws around the world.
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.