GDPR (General Data Protection Regulation)

Data
About 1 min read

A regulation enacted to protect the personal data of EU citizens, serving as a legal standard applicable to all organizations worldwide that process data of data subjects within the EU, regardless of the company's location.

Also known as
General Data Protection Regulation2016/679EU Personal Data Protection Regulation

Detailed explanation

Enacted in 2018, GDPR is a regulatory framework centered on strengthening data subjects' rights and corporate accountability. In the AI landscape, the 'right not to be subject to automated decision-making (Article 22)' and the 'right to explanation' are particularly critical. AI tools must incorporate Privacy by Design, and when collected data is used for model training, the legal basis and clarity of purpose must be proven. Violations of the regulation can lead to administrative fines of up to 4% of a company's global annual turnover or €20 million, whichever is higher. Operating complementarily to the EU AI Act that entered into force in 2024, GDPR serves as an essential legal foundation for AI governance in terms of personal data protection.

Why it matters in tool selection

Since AI tools process large-scale data, using non-GDPR-compliant tools may expose the adopting company to joint liability or massive fines due to unauthorized data training or leaks. In addition, tools that fail to technically implement user deletion requests (the right to be forgotten) present long-term legal risks.

What to check

  • Check if input data is utilized for model retraining, and if there is a setting to opt-out.
  • Is the data storage location and protective measures for cross-border transfers (such as SCCs) specified in the Data Processing Agreement (DPA)?
  • Does it provide a technical interface that allows users to request access, correction, or deletion of their data?

Compliance example

When adopting an enterprise AI chatbot, personal identifiable information (PII) in input customer consultation data is automatically masked, and the system is set to exclude that data from AI model performance improvement training, complying with the principles of data minimization and purpose limitation.