Where AI meets personal data protection
Most business AI projects involve personal data at some point: customer data for segmentation models, employee data for HR systems, patient data for assisted diagnosis, or behavioral data for personalization. That means any AI project at a European company must comply with both the General Data Protection Regulation (GDPR) and, since 2025, the EU AI Act.
This dual obligation isn’t an insurmountable obstacle, but it does call for a structured approach that builds privacy in from the design stage — not as an add-on at the end of the project.
GDPR in AI projects: the critical points
Legal basis for processing: before training any model on personal data, you need to identify the legal basis for that processing (consent, legitimate interest, contract, legal obligation). Legitimate interest is the most common basis in analytics projects, but it requires a documented balancing test.
Data minimization: the GDPR requires using only the data strictly necessary for the stated purpose. In ML projects, that means assessing whether you can train equally effective models on anonymized or pseudonymized data, or on a smaller subset of variables.
Data protection impact assessment (DPIA): mandatory when processing involves systematic evaluation of individuals, large-scale processing of sensitive data, or systematic monitoring of publicly accessible areas. Most scoring, behavior prediction, or people classification models require a DPIA before deployment.
Automated decisions: Article 22 of the GDPR prohibits decisions based solely on automated processing that significantly affect individuals, with some exceptions. If an AI model makes credit, hiring, or pricing decisions without human oversight, you must guarantee the right to human intervention and to an explanation.
International transfers: many cloud and AI providers process data outside the EEA. You need to verify the transfer mechanisms (standard contractual clauses, adequacy decisions) before contracting AI services that process EU residents’ personal data.
EU AI Act: what companies need to know
The EU AI Act classifies AI systems by risk. For most companies, the key points are:
High-risk systems: AI used in credit, employment, education, critical infrastructure, and social welfare. These systems require a conformity assessment, registration, technical documentation, risk management, and documented human oversight.
Limited-risk systems: chatbots and recommendation systems carry transparency obligations (users must know they’re interacting with AI).
General-purpose AI (GPAI): large language models used in business applications have their own transparency and copyright obligations.
Prohibited practices: since February 2025, social scoring systems, subliminal manipulation, and certain uses of facial recognition in public spaces are banned.
A compliance roadmap for companies
A practical privacy roadmap for AI projects includes: an inventory of existing AI systems and their risk classification under the EU AI Act; a review of outstanding DPIAs for projects that process personal data; privacy by design in new projects; procedures for handling data subject rights; and a review of contracts with AI vendors acting as data processors.
At AIRES, we combine technical AI expertise with a deep understanding of the European regulatory framework to guide companies through this process — avoiding both the risk of non-compliance and the over-compliance that stalls innovation.
Frequently asked questions
Is anonymized data outside the scope of the GDPR? Yes, if the anonymization is genuine and irreversible. But pseudonymization — which is what most projects actually do — doesn’t take data outside the GDPR. True anonymization that withstands a re-identification test is technically demanding and often reduces the data’s usefulness for training models.
Does the EU AI Act apply to every company, or only to those that develop AI? It applies to both providers (those who develop AI systems or place them on the market) and deployers (those who use AI systems in their business). A company that buys an AI-based credit scoring system has obligations as a deployer, even if it didn’t build the model.
What if we already have models in production that weren’t compliant? The EU AI Act has transition periods for pre-existing systems. However, data protection authorities across the EU, coordinated by the European Data Protection Board (EDPB), are already actively supervising the use of AI under the GDPR. The prudent course is to audit your existing systems, prioritize the highest-risk ones, and set up a documented remediation plan.