GDPR & Privacy

Your AI Runs on Personal Data. Here's What the GDPR Expects in 2026

A practical guide for business owners, marketers and product teams. This article is for general information only and is not legal advice.

By Zirlandia Milkovic · 2026-10-17 · 9 min read

Illustration of an AI system connected to documents, customer records and privacy safeguards under the GDPR

Every AI tool your company uses or builds has two sides: the model, and the data behind it.

That data includes customer emails, CRM records, support tickets, photos, and posts scraped from the public web. When it relates to an identifiable person, the EU's General Data Protection Regulation (GDPR) applies.

The GDPR — Regulation (EU) 2016/679 — covers any "processing" of personal data. AI systems process it at three points:

Training. Datasets often contain names, faces, voices, or behavioural data, collected directly or scraped from the web.
Inference. Prompts typed into a chatbot, or customer data fed into a scoring model, are processed every time the system runs.
Outputs. A model can generate statements about real people, including false ones.

The model itself may be in scope

In Opinion 28/2024, adopted on 17 December 2024, the European Data Protection Board (EDPB) said AI models trained on personal data cannot automatically be treated as anonymous.

A model counts as anonymous only if the likelihood of extracting personal data from it, or getting that data out through queries, is "insignificant". This is assessed case by case, and documenting it is your job.

Choosing a legal basis for training

Under Article 6 GDPR, every processing operation needs a legal basis. For AI training, the realistic options are usually consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)).

Consent must be freely given, specific, informed, and easy to withdraw. That rarely works at scale, or for scraped data.

Many large developers therefore rely on legitimate interest, which the EDPB accepts only after a documented three-step test:

Legitimate interest: lawful, clearly articulated, and real and present. The EDPB's examples include building a conversational agent or detecting fraud.
Necessity: the processing must actually serve that interest, with no less intrusive alternative. Data minimisation is central.
Balancing: people's rights and reasonable expectations must not override that interest. Safeguards such as filtering and easy opt-outs can tip the balance.

The Meta example

In June 2024, Meta paused plans to train on EU users' public posts after the Irish Data Protection Commission (DPC) raised concerns.

After the EDPB opinion, Meta added safeguards (de-identification, objection forms) and set 27 May 2025 as its start date. The DPC did not prohibit the processing, and on 23 May 2025 the Higher Regional Court of Cologne rejected a request for an urgent injunction.

Special categories (health, biometric data) are stricter: Article 9 requires a specific exception; legitimate interest alone is not enough.

The core principles, applied to AI

Article 5 GDPR sets out principles regulators return to again and again:

Purpose limitation. Data collected to deliver a service cannot automatically be reused for training; reuse needs a compatibility assessment or a new legal basis.
Data minimisation. "Collect everything just in case" is the opposite of the law. Filter and pseudonymise.
Transparency. Articles 13 and 14 require telling people how their data is used, including data obtained indirectly.
Accuracy. AI can "hallucinate" false facts about real people; inaccurate personal data must be corrected or erased.

Automated decisions and Article 22

Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, when it produces legal or similarly significant effects — think loan approvals or CV screening.

Such decisions are allowed only under specific exceptions (contract, law, or explicit consent), with human intervention and the right to contest the outcome. The EU Court of Justice has read this broadly:

SCHUFA (C-634/21, 7 December 2023): an automatically calculated credit score can itself be an "automated decision" when a lender relies on it heavily.
Dun & Bradstreet Austria (C-203/22, 27 February 2025): people have a genuine right to an explanation of the "procedure and principles actually applied". A formula is not enough, and trade secrets do not justify a blanket refusal.

For product teams: real human review, and explanations people can understand.

Data subject rights in AI systems

People have the right to access their data (Article 15), rectify it (Article 16), have it erased (Article 17), and object to processing (Article 21).

These rights are easy in a database, harder in a trained model. Removing one person's influence may require output filters, retraining, or still-maturing "machine unlearning" techniques.

Technical difficulty does not remove the obligation. Regulators expect safeguards from the start: clean training data, output filters, clear request channels, and documentation of what is feasible. The EDPB also warns that a model built on unlawfully processed data can taint its later use, unless effectively anonymised.

DPIAs: required, not optional

Article 35 requires a Data Protection Impact Assessment (DPIA) when processing is likely to result in a high risk to individuals, particularly with new technologies, systematic evaluation of people, or large-scale sensitive data.

Most significant AI projects qualify. A good DPIA describes the processing, tests necessity and proportionality, and records risks and mitigations — usually the first document a regulator asks to see.

The AI Act (Regulation (EU) 2024/1689) adds to the GDPR rather than replacing it, and states explicitly that it does not affect EU data protection law. The GDPR protects personal data; the AI Act regulates the risks of AI systems themselves.

Key dates:

1 August 2024: entry into force.
2 February 2025: bans on prohibited practices and AI literacy obligations apply.
2 August 2025: obligations for providers of general-purpose AI models apply.
2 August 2026: general application date, including most transparency obligations.

In 2026 the EU adjusted this schedule. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, postponing high-risk obligations to 2 December 2027 for stand-alone systems (recruitment, credit scoring, education) and 2 August 2028 for AI embedded in regulated products. It also banned AI generating non-consensual intimate content or child sexual abuse material.

A separate Digital Omnibus proposal (Commission, November 2025) would amend the GDPR itself, including on legitimate interest for AI development. As of early October 2026, it is not law — still under negotiation in the Council.

What enforcement cases teach us

Clearview AI

Clearview scraped billions of photos from the internet. France's CNIL fined it €20 million in October 2022; the Dutch AP fined it €30.5 million in September 2024, plus up to €5.1 million for non-compliance, and warned Dutch users could be fined too. In October 2025 the UK Upper Tribunal ruled the ICO had jurisdiction and remitted the case on the substance.

OpenAI in Italy

In December 2024, Italy's Garante announced a €15 million fine over ChatGPT, citing, among other things, no valid legal basis for training and inadequate transparency.

On 18 March 2026, the Court of Rome annulled it — not on the alleged violations, but because OpenAI's Irish establishment made the Irish DPC the lead authority under the GDPR's "one-stop shop". Procedure can be as decisive as substance.

A practical checklist

Map your data across training, prompts, and outputs.
Document a legal basis for each purpose; for legitimate interest, record the three-step test.
Screen out special categories (Article 9) where possible.
Minimise: filter, pseudonymise, set retention periods.
Update privacy notices in plain language, including for indirectly collected data.
Run a DPIA before launch; review it when the model or use case changes.
Add human review for decisions with legal or significant effects.
Build a rights-request workflow (access, rectification, erasure, objection) covering models and outputs.
Vet vendors: ask how models were trained; sign data processing agreements.
Classify systems under the AI Act against current deadlines, including December 2027 for stand-alone high-risk systems.
Train your team: AI literacy has been an obligation since February 2025.

A note for Brazilian readers

Under Article 3(2), the GDPR also applies to non-EU companies offering goods or services to people in the EU, or monitoring their behaviour.

Brazil's LGPD (Law 13.709/2018) is similar: Article 20 gives people the right to request review of solely automated decisions. In July 2024, the ANPD ordered Meta to suspend using personal data to train generative AI in Brazil, under threat of a daily fine of R$50,000.

The bottom line

The GDPR does not prohibit AI; it requires AI built with care: a clear legal basis, clean data, transparency, human oversight, and good documentation. The AI Act will add requirements, but the GDPR's core principles are here to stay.

Your AI Runs on Personal Data. Here's What the GDPR Expects in 2026

Your AI Runs on Personal Data. Here's What the GDPR Expects in 2026

Why the GDPR applies at every stage

The model itself may be in scope

Choosing a legal basis for training

The Meta example

The core principles, applied to AI

Automated decisions and Article 22

Data subject rights in AI systems

DPIAs: required, not optional

How the GDPR and the AI Act fit together

What enforcement cases teach us

Clearview AI

OpenAI in Italy

A practical checklist

A note for Brazilian readers

The bottom line

Sources