AI and GDPR: who is responsible for the data?
Data-protection rules still apply when an organisation uses AI.
What is it?
The General Data Protection Regulation (GDPR) also applies when an organisation uses AI. It needs a legal basis for processing, has to use as little data as possible, protect it and let people exercise their rights, such as access and correction.
An everyday example
A company wants to analyse customers’ emails with AI. It first has to check whether it has a legal basis and whether it can anonymise the data before analysis.
Why does it matter?
Personal data can spread widely through AI systems and be hard to delete. The GDPR gives people the right to know what happens to them.
A common misconception
That using AI is an exception to data-protection rules, or that every use needs consent. It depends on the purpose and the legal basis.
In more detail
What is personal data?
Information relating to an identifiable person, directly or indirectly.
Is consent always needed to use AI?
No. The GDPR has several legal bases, depending on the circumstances. Consent is one of them, not a universal rule.
What does data minimisation mean?
Only the data needed for a specific, lawful purpose may be processed.
What can I ask an organisation?
What data it processes, why, for how long, who it passes it to, and how you can exercise your rights.
Remember: Using AI does not cancel the duty to protect personal data.
Reliable sources
Last reviewed 1 November 2026. An explainer, not professional, legal or medical advice. For rules and figures that change, check the official version.