General Data Protection Regulation
In plain wordsThe European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems.
Regulation (EU) 2016/679, the EU's general law on processing personal data, applying since 25 May 2018 to organizations established in the EU and to others that offer goods or services to, or monitor, people in the EU. It requires a lawful basis for processing, such as consent or legitimate interests; imposes principles including purpose limitation, data minimization, accuracy and storage limitation; gives people rights of access, rectification, erasure and objection; and in Article 22 limits decisions with legal or comparably serious consequences that are made by automated processingautomated decision-making, n.: When a computer system, rather than a person, makes or effectively makes a decision about someone — such as approving credit, screening job applicants or flagging possible welfare fraud. alone. For AI it governs personal data in training sets, including scraped web data, the handling of personal data that models may memorize, and data protection impact assessments for high-risk processing. Fines reach €20 million or 4% of worldwide annual turnover.
The regulator questioned whether legitimate interests under the GDPR could justify training on scraped social-media posts.
Origin
Proposed by the European Commission in January 2012 to replace the 1995 Data Protection Directive, adopted on 27 April 2016 and applicable from 25 May 2018. Data protection authorities became early enforcers against generative AI, as when Italy's regulator temporarily restricted ChatGPT in March 2023.
Usage note
Often cited as the clearest example of the Brussels effectBrussels effect, n.: The way European Union rules end up shaping products and laws worldwide, because global companies often find it simpler to follow the strictest big market's rules everywhere.. Scholars still debate whether it grants a right to explanationright to explanation, n.: The idea that a person affected by a decision made or shaped by an algorithm — a refused loan, a rejected job application — is entitled to a meaningful account of why. of automated decisions. The 2025 Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year. package proposed amendments — notably recognizing AI development as a legitimate interest, with a right to object — that, as of mid-October 2026, had not yet reached trilogue negotiations.
Related
- Brussels effectBrussels effect, n.: The way European Union rules end up shaping products and laws worldwide, because global companies often find it simpler to follow the strictest big market's rules everywhere.
- automated decision-makingautomated decision-making, n.: When a computer system, rather than a person, makes or effectively makes a decision about someone — such as approving credit, screening job applicants or flagging possible welfare fraud.
- right to explanationright to explanation, n.: The idea that a person affected by a decision made or shaped by an algorithm — a refused loan, a rejected job application — is entitled to a meaningful account of why.
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person.
- fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm.
Defined in law or standards
Regulation (EU) 2016/679, Art. 4 (definitions), Art. 22 (automated individual decision-making), Art. 35 (data protection impact assessment)
Mentioned in
EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared., biometric databiometric data, n.: Information about your body or behavior — your face, fingerprints, voice, eyes or the way you walk — measured by technology and used to recognize who you are or to guess things about you., Brussels effectBrussels effect, n.: The way European Union rules end up shaping products and laws worldwide, because global companies often find it simpler to follow the strictest big market's rules everywhere., data protectiondata protection, n.: Laws and practices that control how organizations collect, use, store and share information about people, and that give people rights over it, such as seeing it or having it deleted., Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year., provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes., remote biometric identificationremote biometric identification, n.: Using AI to recognize people at a distance — usually by matching faces in camera footage against a database — without their taking part. The EU strictly limits live police use of it in public places., fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm., Product Liability DirectiveProduct Liability Directive, prop. n.: The EU law that lets people claim compensation, without proving anyone was careless, when a defective product injures them — rewritten in 2024 so that software and AI count as products.