GDPR × AI — supervisory practice keeps moving

The intersection of GDPR and AI — lawful bases for model training, transparency towards data subjects, DPIA expectations and the reach of automated-decision rules — is being defined case by case. Documented reasoning is the only stable defence while guidance converges.

Monitor: EDPB outputs and your lead authority’s decisions; re-date your AI DPIAs and legitimate-interest assessments at least annually.

Official source → · Last verified: 2026-07-18

This material is provided for general information and does not constitute legal, investment, tax, audit or other regulated professional advice. Its application depends on the facts, jurisdiction and current law. Verify the current status of the cited sources and obtain appropriate advice before acting.