Skip to content
AI Policy Generator

ESWhat applies

European Union · Regulation

General Data Protection Regulation (GDPR)

In forceGDPR

Summary

Today it is the rule with the most practical weight for AI use: almost every AI system processes personal data. It requires a legal basis, clear information, impact assessments for risky processing, vendor contracts and safeguards against automated decisions. The EU Court of Justice has strengthened the right to understand the logic of those decisions.

Who it applies to

Any organization processing personal data in the EU or of people in the EU.

Penalties

Up to EUR 20M or 4% of worldwide annual turnover, whichever is higher.

Official name
Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos (Reglamento general de protección de datos)
Official reference
Reglamento (UE) 2016/679, DO L 119 de 4.5.2016; aplicable desde el 25.5.2018
Regulator
National data protection authorities (AEPD in Spain) and the European Data Protection Board
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Principles and legal basis for processing data with AIRGPD, arts. 5 y 6; Dictamen 28/2024 del CEPDIn forceAlready applicableIf your AI use processes personal data (customers, employees, candidates, users).Verified in the official source on October 31, 2026
Inform people and explain the logic of automated decisionsRGPD, arts. 13, 14 y 15(1)(h); STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In forceAlready applicableIf you process personal data with AI, especially to profile or decide about people.Verified in the official source on October 31, 2026
Safeguards against solely automated decisionsRGPD, arts. 13.2.f), 14.2.g), 15.1.h) y 22; STJUE C-634/21, SCHUFA, 7-dic-2023; STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In forceAlready applicableIf AI makes, or in practice determines, decisions with legal or similarly significant effects on people without meaningful human involvement: hiring, credit, insurance, education, benefits, pricing or access to services. Diagnostic support reviewed by a clinician is usually not a solely automated decision.Verified in the official source on October 31, 2026
Data processing agreements with AI vendorsRGPD, art. 28In forceAlready applicableIf an AI vendor processes personal data on your behalf (typical for cloud AI).Verified in the official source on October 31, 2026
Records of processing activities including AIRGPD, art. 30In forceAlready applicableIf you regularly process personal data with AI.Verified in the official source on October 31, 2026
Security and breach notificationRGPD, arts. 32-34In forceAlready applicableIf you process personal data with AI.Verified in the official source on October 31, 2026
Data protection impact assessment (DPIA)RGPD, art. 35In forceAlready applicableIf you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.Verified in the official source on October 31, 2026
Data transfers to AI vendors outside the EEARGPD, arts. 44-49In forceAlready applicableIf you send personal data to AI vendors in other countries (for example, the US).Verified in the official source on October 31, 2026

Principles and legal basis for processing data with AI

RGPD, arts. 5 y 6; Dictamen 28/2024 del CEPDIn force

Already applicable

When it relates
If your AI use processes personal data (customers, employees, candidates, users).
What the rule provides
  • Define the purpose of each AI use and limit data to what is necessary.
  • Choose a legal basis. If it is legitimate interest, document the three-step test: interest, necessity and balancing.
  • When training or fine-tuning models on your own data, assess whether the resulting model still contains personal data.
Typical evidence
  • Legitimate-interest assessment or analysis of the chosen basis.
  • Data minimization and retention rules.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Inform people and explain the logic of automated decisions

RGPD, arts. 13, 14 y 15(1)(h); STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In force

Already applicable

When it relates
If you process personal data with AI, especially to profile or decide about people.
What the rule provides
  • Include in privacy notices the use of AI, its purposes and, where automated decisions exist, meaningful information about the logic involved.
  • When answering an access request, explain the procedure and principles applied so the person understands which data were used and how. Handing over the algorithm is not enough.
  • Trade secrets do not justify refusing all information: it must be given to the authority or court to weigh.
Typical evidence
  • Updated privacy notices.
  • Access-request procedure and response log.
Verification
Verified in the official source on October 31, 2026Judgment C-203/22 confirmed in the CJEU's official press release (CURIA).

Safeguards against solely automated decisions

RGPD, arts. 13.2.f), 14.2.g), 15.1.h) y 22; STJUE C-634/21, SCHUFA, 7-dic-2023; STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In force

Already applicable

When it relates
If AI makes, or in practice determines, decisions with legal or similarly significant effects on people without meaningful human involvement: hiring, credit, insurance, education, benefits, pricing or access to services. Diagnostic support reviewed by a clinician is usually not a solely automated decision.
What the rule provides
  • Avoid decisions based solely on automated processing unless needed for a contract, authorized by law or based on explicit consent.
  • Where allowed, provide real human intervention and the ability to give one's view and contest the decision.
  • A third-party score that determines the decision also counts as an automated decision.
  • Disclose that the automated decision exists and, on request, give meaningful information about the logic involved and its consequences. The law does not require a specific letter format.
Typical evidence
  • Human review procedure with timelines and owners.
  • Log of decisions and reviews.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data processing agreements with AI vendors

RGPD, art. 28In force

Already applicable

When it relates
If an AI vendor processes personal data on your behalf (typical for cloud AI).
What the rule provides
  • Sign a processing agreement setting instructions, confidentiality, security, sub-processors and data return or deletion.
  • Prohibit or regulate the vendor's use of your data to train its models.
  • Use only vendors with sufficient guarantees and review them periodically.
Typical evidence
  • Signed processing agreements.
  • Assessment of each vendor.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Records of processing activities including AI

RGPD, art. 30In force

Already applicable

When it relates
If you regularly process personal data with AI.
What the rule provides
  • Add each AI processing activity to the record: purpose, data categories, recipients, transfers, retention and security measures.
  • The exemption for fewer than 250 employees does not apply if processing is regular, risky or involves sensitive data, which is typical with AI.
Typical evidence
  • Updated record of processing activities.
Supporting documents
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Security and breach notification

RGPD, arts. 32-34In force

Already applicable

When it relates
If you process personal data with AI.
What the rule provides
  • Apply risk-appropriate security, including AI-specific risks such as leaks through malicious prompts.
  • Notify the authority within 72 hours of risky breaches, and the people affected if the risk is high.
Typical evidence
  • Breach procedure and incident log.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data protection impact assessment (DPIA)

RGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data transfers to AI vendors outside the EEA

RGPD, arts. 44-49In force

Already applicable

When it relates
If you send personal data to AI vendors in other countries (for example, the US).
What the rule provides
  • Verify the basis for each transfer: adequacy decision (for example, the EU-US Data Privacy Framework) or standard contractual clauses.
  • Run a transfer impact assessment when relying on standard clauses.
Typical evidence
  • Transfer map and signed clauses.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)