Last reviewed:
How does the GDPR apply to AI? Definition and business implications
GDPR governs all personal-data processing by an AI system operated in the European Union or targeting people located there. Four obligations apply as priorities: explicit purpose, data minimisation, access and opposition rights, and impact assessment for high-risk processing.
The General Data Protection Regulation (GDPR, European Regulation 2016/679) applies to any AI system as soon as it processes personal data (name, email, IP address, purchase history, image, voice). Four obligations structure the analysis for AI deployments. Explicit purpose: an AI system can only process data for uses clearly defined in advance and notified to the persons concerned. Minimisation: only data strictly necessary for the purpose is processed, no more. Rights of persons: access, rectification, opposition, portability, erasure. Impact assessment (DPIA, Data Protection Impact Assessment): mandatory where the processing is likely to result in a high risk to the rights and freedoms of individuals (Article 35 GDPR), assessed case by case against the CNIL's criteria and list. The CNIL has published recommendations on the development of AI systems. On 19 June 2025, it added guidance sheets on legitimate interest and on web scraping. They are the reference in France.
Concrete example
A French e-commerce company deploys an AI chatbot for its customer service. Three GDPR questions to settle before going to production. First, on what legal basis does the processing rest (consent, legitimate interest, contractual performance)? Second, are the conversations transmitted to a processor outside the EU (OpenAI, Anthropic via API)? If so, a transfer mechanism is needed: an adequacy decision (the Data Privacy Framework for a participating US provider) or, failing that, standard contractual clauses and a transfer impact assessment (TIA). Third, for how long are the conversations retained? Without a precise answer on these three points, the deployment is legally fragile, and the CNIL can issue an administrative fine of up to 20 million euros or 4% of worldwide annual turnover of the preceding financial year, whichever is higher (Article 83 GDPR).
FAQ
Does the GDPR apply to an AI tool that uses my data?
Yes, as soon as it processes personal data (name, email, IP address, image, voice), whether the system runs in the European Union or targets people located there. Four obligations come first: explicit purpose, data minimisation, data-subject rights (access, objection, erasure) and a data protection impact assessment (DPIA) for processing likely to result in a high risk.
Can I send personal data to a US AI API (OpenAI, Anthropic)?
Not without safeguards. Any transfer outside the EU needs a transfer mechanism: an adequacy decision (the EU-US Data Privacy Framework covers participating US companies) or, failing that, standard contractual clauses with a transfer assessment. You must also qualify the roles: you are usually the controller, the vendor the processor, with an Article 28 processing agreement. Without this, the processing is unlawful.
When is a DPIA mandatory?
Where the processing is likely to result in a high risk to people's rights and freedoms (Article 35). This is assessed case by case, using the criteria and list published by the CNIL. The DPIA is run before go-live, not after.
See also
Further reading
CNIL recommendations on the development of AI systems (page in French)
Sources
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). https://eur-lex.europa.eu/eli/reg/2016/679/oj
- Artificial intelligence, recommendations and guides, CNIL (resource available in French only). https://www.cnil.fr/fr/intelligence-artificielle
- AI: the CNIL finalises its recommendations on the development of AI systems (legitimate interest, web scraping), CNIL, 19 June 2025 (in French). https://www.cnil.fr/fr/recommandations-developpement-ia-interet-legitime
- EU-US data transfers, adequacy decision of 10 July 2023 (Data Privacy Framework), European Commission. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en