What it means
The General Data Protection Regulation (in German, Datenschutz-Grundverordnung, DSGVO) is the EU law that governs how personal data is collected, used, stored and shared. It applies to AI systems whenever they process personal data, including in training data, user inputs and outputs.
Real-world example
A hospital wants to use AI to summarise patient histories. Health data is a special category of personal data under the GDPR, so the hospital involves its data protection officer, identifies a legal basis, carries out a data protection impact assessment, limits which data is processed, and ensures a data processing agreement is in place with any service provider.
Why it matters for AI adoption
Many AI projects involve personal data in ways that are easy to overlook, such as staff pasting citizen emails into a chatbot. GDPR principles like purpose limitation, data minimisation and transparency apply, and individuals have rights regarding certain automated decisions. GDPR and the EU AI Act apply side by side.
Questions to ask
- Does this system process personal data, and what is our legal basis?
- Has a data protection impact assessment been done, and has our data protection officer been involved?