Summary

Under Article 35, a Data Protection Impact Assessment (DPIA) is mandatory when processing is “likely to result in a high risk” to individuals. AI systems almost always trigger this requirement because they typically involve: Article 25 requires privacy by design and by default. For AI companies, this means:

GDPR Guide for AI Companies: What You Need to Know in 2024

Artificial intelligence companies face some of the most complex data protection challenges in the modern regulatory landscape. When your core product is data — consuming it, learning from it, generating outputs from it — the General Data Protection Regulation (GDPR) touches nearly every layer of your business. This guide breaks down the key obligations, practical steps, and common pitfalls AI companies encounter when building GDPR-compliant products and processes.

Why GDPR Is Especially Challenging for AI Companies

GDPR was designed with traditional data processing in mind. AI systems introduce unique complications:

Data minimization vs. model training: Machine learning models often need large, diverse datasets, which conflicts with GDPR’s principle that you should collect only what is strictly necessary.
Explainability requirements: GDPR gives individuals the right to explanation for automated decisions, but many AI models are inherently opaque.
Purpose limitation: Data collected for one purpose cannot simply be repurposed to train a new model without a fresh legal basis.
Erasure challenges: Deleting a specific individual’s data from a trained model is technically complex — sometimes impossible without retraining.

Regulators across Europe are actively scrutinizing AI companies. Fines for non-compliance can reach €20 million or 4% of global annual turnover, whichever is higher.

Step 1: Establish Your Legal Basis for Processing

Before collecting or processing any personal data, you must identify a valid legal basis under Article 6 of the GDPR. For AI companies, the most relevant options are:

Legitimate Interests (Article 6(1)(f))

This is commonly used for training internal models or improving products. However, you must conduct and document a Legitimate Interests Assessment (LIA) showing that your interests are not overridden by the data subject’s rights.

Consent (Article 6(1)(a))

Consent must be freely given, specific, informed, and unambiguous. For AI training purposes, regulators have been skeptical of consent as a catch-all basis — particularly when it is buried in terms of service.

Contract (Article 6(1)(b))

If processing is necessary to fulfill a contract with the individual (e.g., delivering a personalized AI-powered service), this basis may apply — but only for processing that is genuinely necessary.

Special Category Data

If your AI processes health data, biometric data, or other sensitive categories under Article 9, you need both an Article 6 basis and a separate Article 9 condition. This is a common oversight that leads to enforcement action.

Step 2: Conduct Data Protection Impact Assessments (DPIAs)

Systematic and extensive profiling
Large-scale processing of personal data
Use of new technologies

A DPIA must include:

A description of the processing and its purposes
An assessment of necessity and proportionality
An assessment of risks to individuals
Measures to mitigate those risks

Do not treat DPIAs as a checkbox exercise. Regulators review them during investigations, and a superficial DPIA can make your situation worse, not better.

Step 3: Address Automated Decision-Making Under Article 22

Article 22 gives individuals the right not to be subject to solely automated decisions that produce legal or similarly significant effects. This is one of the most practically impactful rules for AI companies.

If your AI makes or significantly influences decisions about:

Credit or insurance eligibility
Job applications
Medical diagnoses
Content moderation leading to account bans

…then Article 22 applies. You must either:

Ensure a human is meaningfully involved in the decision (not just rubber-stamping)
Obtain explicit consent for the automated processing
Demonstrate the decision is necessary for a contract

You must also be able to provide meaningful information about the logic involved and allow individuals to contest decisions and request human review.

Step 4: Handle Data Subject Rights at Scale

GDPR grants individuals eight core rights. For AI companies, three are particularly difficult to operationalize:

Right to Erasure (“Right to Be Forgotten”)

If a user requests deletion of their data, you must remove it from your databases — but what about models trained on that data? The current regulatory guidance suggests you may not need to retrain models if the data has been properly anonymized during training, but this is an evolving area. Document your approach carefully.

Right to Access

Individuals can request a copy of all personal data you hold about them. This includes any profiles, inferences, or outputs generated about them by your AI system.

Right to Portability

Data provided by the user must be exportable in a machine-readable format. Build this capability into your product architecture early — retrofitting it is expensive.

Build internal workflows and response timelines. You have one month to respond to subject access requests, with a possible two-month extension for complex cases.

Step 5: Govern Your Data Supply Chain

Many AI companies use third-party datasets, APIs, or data brokers to supplement their training data. This creates significant GDPR exposure.

Vendor due diligence: Ensure any data supplier has a lawful basis for sharing data with you and can demonstrate it in writing.
Data Processing Agreements (DPAs): Required whenever you share personal data with a processor. These must contain specific clauses mandated by Article 28.
International transfers: If data flows outside the EU/EEA (e.g., to US-based cloud infrastructure), you need an appropriate transfer mechanism — Standard Contractual Clauses (SCCs) are the most common.

Step 6: Build Privacy by Design Into Your AI Systems

Article 25 requires privacy by design and by default. For AI companies, this means:

Minimizing personal data in training sets wherever possible (consider synthetic data or anonymization techniques)
Applying pseudonymization to training data
Limiting access to personal data within your engineering team
Designing model outputs so they do not inadvertently expose personal data about training individuals
Regularly auditing models for data leakage

Privacy by design is not just a legal obligation — it reduces your attack surface and builds user trust.

Staying Current: The EU AI Act Intersection

GDPR compliance is now only part of the picture. The EU AI Act, which entered into force in 2024, introduces a risk-based framework specifically for AI systems. High-risk AI applications (hiring, credit, healthcare, law enforcement) face additional requirements around transparency, human oversight, and technical documentation.

GDPR and the EU AI Act overlap significantly. Building robust GDPR compliance now creates a strong foundation for AI Act compliance as its provisions phase in through 2025 and 2026.

FAQ: GDPR for AI Companies

Can I use publicly available data to train my AI model under GDPR?

Not automatically. “Publicly available” does not mean “freely usable for any purpose.” You still need a valid legal basis, and individuals whose data appears publicly online retain their GDPR rights. Web-scraped data is an area of active regulatory scrutiny.

Do I need a Data Protection Officer (DPO)?

You are required to appoint a DPO if your core activities involve large-scale, systematic monitoring of individuals or large-scale processing of special category data. Many AI companies meet this threshold. Even if not legally required, appointing a DPO is considered best practice.

What happens if a user asks me to delete data that was used to train my model?

This is genuinely complex. If the model was trained on properly anonymized data, most guidance suggests retraining is not required. If the data was not anonymized, you face a harder question. Document your technical approach and legal rationale in advance — do not wait for a request to figure this out.

How do I handle GDPR when using third-party AI APIs (like OpenAI or similar)?

When you send personal data to a third-party AI API, that provider becomes a data processor. You need a valid Data Processing Agreement in place and must ensure the provider’s data handling meets GDPR standards. Review their terms carefully — some providers use API inputs to improve their models by default.

Is consent always required for AI-based profiling?

No. Consent is one legal basis but not the only one. Legitimate interests or contractual necessity may apply depending on context. However, consent is required for automated decision-making under Article 22 in certain circumstances.

Build Your GDPR Compliance Foundation Today

Understanding GDPR is one thing — implementing it across your AI company’s operations is another. Drafting compliant privacy notices, DPIAs, LIAs, Data Processing Agreements, and internal policies from scratch is time-consuming and easy to get wrong.

Our ready-to-use GDPR compliance template bundle for AI companies gives you professionally drafted, regulation-aligned documents you can customize and deploy immediately, including:

AI-specific DPIA template
Legitimate Interests Assessment (LIA) template
Data Processing Agreement (DPA) template
Privacy notice for AI products
Data Subject Rights request workflow
Article 22 automated decision-making policy

Stop starting from a blank page. Get the AI Company GDPR Template Bundle → and have audit-ready documentation in place before your next product launch or investor due diligence review.