GDPR and AI — Fundamentals

AI systems process data — and when that data is personal, GDPR applies. In this lesson, we clarify when and how GDPR applies to AI applications and what responsibilities arise.

When Is GDPR Relevant for AI?

GDPR applies whenever an AI system processes personal data. This includes:

• Obviously personal: Name, email, phone number, photo
• Indirectly personal: IP addresses, location data, behavioral patterns
• AI-specific problems: Free-text inputs in chatbots, voice recordings, facial images
• Training data: When the model was trained with personal data

Common Misconception: "We only use an API"

Even when using an external LLM via API (e.g., OpenAI, Anthropic), you process personal data when:

• Users enter free text containing names, addresses, or other personal information
• You send customer data to the model for analysis
• Metadata (IP, session ID) is transmitted to the API provider

Clarifying Responsibilities

GDPR distinguishes three roles:

Key point: As a company deploying an AI tool, you are typically the controller — even when actual AI processing happens at the provider. You bear the compliance responsibility.

The 7 GDPR Principles in the AI Context

Special Categories of Personal Data

AI systems often unintentionally process sensitive data (Art. 9 GDPR):

• Health data (in free-text inputs)
• Biometric data (voice, face)
• Political opinions or religious beliefs (in text analyses)
• Trade union membership (in HR documents)

Consequence: Processing special categories is generally prohibited — unless one of the narrow exceptions in Art. 9(2) GDPR applies (e.g., explicit consent).

Practical Tip: Create a record of processing activities (Art. 30 GDPR) for each AI system. It's mandatory — and helps you maintain oversight at the same time.