Answers
GDPR and AI: Rules for Processing EU Personal Data
GDPR is the European Union regulation that sets rules for collecting, storing, and processing personal data belonging to EU residents. An AI system that ingests customer records, support tickets, or employee data falls under GDPR the same way a traditional database does, with added scrutiny on automated decisions.
01What personal data does GDPR cover in an AI system?
GDPR covers any information that identifies or can identify a living person, including names, emails, IP addresses, and behavioral data used to personalize a response. An AI system that stores chat transcripts, resumes, or support tickets containing that information must treat it under GDPR rules, regardless of where the AI vendor is based.
Anonymized data that truly cannot be linked back to a person falls outside GDPR, but data that is merely pseudonymized, such as a customer ID without a name attached, generally still counts as personal data under the regulation.
02What rights does GDPR give people whose data trains or feeds an AI system?
GDPR gives individuals the right to access their data, correct it, request deletion, and object to automated decision making that produces legal or similarly significant effects. A person can request that a company explain how an AI driven decision about them was made and ask for human review.
These rights create practical obligations: a company must be able to locate a specific person's data inside training sets, logs, or vector stores and remove it on request, which is harder in systems that were not designed with deletion in mind.
03Does GDPR restrict automated decision making by AI?
Article 22 of GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects on a person, such as loan denials or hiring rejections, unless specific conditions are met, including consent or a documented human review step.
A company using AI to score or rank applicants, customers, or claims should build in a human review point for consequential decisions, both to meet this rule and to catch errors an automated system alone would miss.
04What is a data processing agreement and why does it matter for AI vendors?
A data processing agreement is a contract between a data controller and a data processor that spells out how personal data is handled, secured, and deleted. Any company sending EU personal data to an AI vendor for processing needs a signed data processing agreement with that vendor before sending real customer data.
The agreement should specify whether the vendor uses submitted data to train shared models, where the data is stored geographically, and how long it is retained, since these terms determine actual GDPR exposure.
05Does Lingows AI provide GDPR certification for clients?
No regulator issues a formal GDPR certification that a vendor can claim to hold, and Lingows AI does not represent itself as GDPR certified. Lingows AI helps clients design AI workflows with data minimization, access controls, and deletion processes that support a client's own GDPR compliance program.
Final responsibility for GDPR compliance sits with the data controller, typically the client organization, so any AI vendor relationship should include a review by the client's own legal or privacy counsel.
06GDPR concepts relevant to AI projects
| Concept | Definition | Why it matters for AI |
|---|---|---|
| Data controller | Entity that decides why and how data is processed | Usually the client company deploying the AI system |
| Data processor | Entity that processes data on the controller's behalf | Often the AI vendor handling the underlying infrastructure |
| Right to erasure | Right for a person to request deletion of their data | Requires the AI system to locate and remove specific records |
| Article 22 | Restriction on solely automated significant decisions | Requires human review for consequential AI driven outcomes |
| Data processing agreement | Contract governing data handling between parties | Required before sending EU personal data to any vendor |
07Specification
| Field | Detail |
|---|---|
| Typical cost | Legal and compliance review costs vary by organization size and are typically budgeted separately from the AI project itself |
| Typical timeline | A data processing agreement review commonly adds two to four weeks to vendor onboarding |
| Prerequisites | A documented data map showing what personal data flows into the AI system and from which source systems |
| Common failure modes | Teams send real customer data into a pilot before a data processing agreement is signed with the AI vendor |
| Who it suits | Any organization processing personal data of EU residents through an AI system, regardless of company location |
FAQQuestions
Related questions
Does GDPR apply to a US company using AI on EU customer data?
Yes. GDPR applies based on whose data is processed, not where the processing company is headquartered, so a US company handling EU resident data must comply.
Can an AI vendor train its models on a client's data under GDPR?
Only if the data processing agreement explicitly permits it and a valid legal basis exists; silence in a contract should not be read as permission.
What counts as a GDPR breach involving AI?
Any unauthorized access, loss, or disclosure of personal data processed by the AI system counts, including data exposed through logs, prompts, or misconfigured storage.
Does anonymized training data avoid GDPR entirely?
Only if the anonymization is irreversible and no reasonable method exists to re-identify individuals; weakly pseudonymized data usually still falls under GDPR.
NEXTWhere to go next
Security and data handling is the Lingows AI page that covers this work in delivery detail, including scope, timeline, and how the build is run.
Last reviewed 2026-08-16