Guide, Data Protection and AI
GDPR Compliance AI Guide for US Firms With EU Exposure
How the established principles of the GDPR apply to AI systems that touch personal data, written for US healthcare, life sciences, financial services and insurance firms with EU customers, patients, trial sites or staff.
GDPR compliance AI work applies the same rules to an AI system that the GDPR applies to any processing of personal data: a lawful basis for each purpose, data minimisation, a DPIA where the processing is likely to be high risk, safeguards for solely automated decisions under Article 22, working data subject rights, contracts with processors, and a valid mechanism for international transfers. The GDPR has no separate AI chapter; the difficulty is applying its principles to training data, model outputs and AI vendors.
who this is for
GDPR and AI: Why US Regulated Firms Are in Scope
Our focus is US regulated firms with EU exposure. Many assume the GDPR is a European problem. It reaches further than that.
The GDPR applies to organisations established in the EU, and also to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Article 3). A US insurer with EU policyholders, a bank with EU clients, a health system treating EU patients through a European affiliate, or a life sciences company running clinical trials with EU sites can all be in scope. Non-EU controllers caught this way generally also need a representative in the EU (Article 27).
HIPAA compliance does not carry over. HIPAA protects specific health information held by covered entities and their business associates. The GDPR protects any information relating to an identifiable person, and treats health, genetic and biometric data as special category data with stricter conditions. A US firm can meet every HIPAA requirement and still have no lawful basis under the GDPR for the same AI use case.
This page explains principles, not your specific obligations, and is not legal advice. Confirm your position with EU data protection counsel and your data protection officer.
lawful basis
Lawful Basis and Purpose Limitation for AI
Every processing purpose in an AI system needs its own lawful basis under Article 6. Training a model and using it to make decisions are different purposes, and they often need different bases.
Choosing a basis
The bases most often relevant to AI are contract, legal obligation, consent and legitimate interests. Legitimate interests requires a documented balancing test showing your interest is not overridden by the individual's rights. Consent must be freely given, specific, informed and as easy to withdraw as to give, which makes it a weak foundation for training a model you cannot easily retrain. Special category data, such as health data, also needs one of the conditions in Article 9.
Reusing data you already hold
Purpose limitation means data collected for one purpose cannot simply be reused to train a model for another. Reuse needs a compatibility assessment that looks at the link between the purposes, the context of collection, the nature of the data, the consequences for individuals and the safeguards in place, or a fresh lawful basis. Document it before training.
minimisation
Data Minimisation, Accuracy and Security in AI Systems
Data minimisation requires personal data to be adequate, relevant and limited to what is necessary (Article 5). For AI, that means justifying each field in a training set, removing direct identifiers where the task does not need them, and preferring pseudonymised or properly anonymised data. Pseudonymised data is still personal data; only data that can no longer be linked to a person falls outside the GDPR.
Accuracy applies to outputs too. A model that generates or infers incorrect information about a person creates an accuracy problem you must be able to correct. Article 25 requires data protection by design and by default, and Article 32 requires security appropriate to the risk, including access control on training data, sensible log retention and protection against leakage through outputs.
dpia for ai
DPIA for AI: When You Need One and What It Covers
Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to individuals. Many AI use cases meet that test.
A DPIA is required in particular for systematic and extensive evaluation of people based on automated processing, including profiling, that produces legal or similarly significant effects; for large-scale processing of special category data; and for systematic monitoring of publicly accessible areas on a large scale. Supervisory authorities also publish lists of processing that needs one. In practice, an AI system that scores, ranks or profiles customers, patients or employees should be assumed to need one.
A DPIA must describe the processing and its purposes, assess necessity and proportionality, assess the risks to individuals, and set out the measures that address those risks. If high risk remains after mitigation, Article 36 requires prior consultation with the supervisory authority before processing begins.
1. Describe the system
Data sources, training and inference flows, model type, vendors, where data is stored and who can access it.
2. Test necessity
Show why AI is needed for the purpose and why less intrusive options were not enough.
3. Assess AI-specific risks
Inaccurate or biased outputs, inference of special category data, re-identification, leakage of training data and the effect of errors on individuals.
4. Record controls and owners
Human review, minimisation, access control, monitoring and the named person accountable for each control.
5. Review on change
Revisit the DPIA when the model, its data or its use changes, not only on a calendar.
article 22
Article 22: Automated Decisions and Profiling
Article 22 gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Credit approvals, insurance pricing and claims outcomes, eligibility decisions and recruitment screening are typical examples. Such decisions are permitted only where necessary for a contract, authorised by law, or based on explicit consent, and must then carry safeguards, including the right to obtain human intervention, to express a view and to contest the decision.
Human review only takes a decision out of Article 22 if it is meaningful: the reviewer has the authority, the information and the time to change the outcome. Individuals must also receive meaningful information about the logic involved and the likely consequences (Articles 13 to 15), so you need an explanation you can actually give.
rights processors transfers
AI GDPR Compliance for Rights, Vendors and Transfers
Data subject rights
Rights of access, rectification, erasure and objection apply to personal data in training sets, prompts, logs and outputs. Removing a person from a trained model is hard, so build the controls at the data pipeline: know which datasets hold whose data, exclude it from future training runs and suppress it in outputs where needed. Record how you handle each right for each system.
Processors and data processing agreements
An AI vendor processing personal data on your behalf is a processor and needs an Article 28 contract covering instructions, confidentiality, security, sub-processors, assistance with rights and deletion or return of data. Check whether the vendor uses your prompts or outputs to train its own models; if it does, it may be acting as a controller for that use, and your contract and transparency notices must reflect it.
International transfers
Sending EU personal data to a US model provider or US data centre is a restricted transfer under Chapter V. It needs an adequacy decision, standard contractual clauses or another Chapter V mechanism, plus an assessment of the destination's risks where the mechanism requires it. Map where every AI vendor stores and processes data, including sub-processors.
gdpr ai act
GDPR and the EU AI Act
The EU AI Act is separate legislation. It regulates AI systems by risk category and places obligations on providers and deployers. It does not replace the GDPR: whenever an AI system processes personal data, the GDPR applies alongside it. Evidence built for one, such as risk assessment and oversight records, can support the other, but meeting one does not mean you meet the other. We have also submitted a separate assessment offer to Microsoft Marketplace, EU AI Act Compliance Assessment (4–6 Wk Cross-Sector), for teams that need both.
checklist
GDPR Compliance AI Checklist, System by System
Use this per AI system. Each line needs an owner and evidence.
| GDPR requirement | What it means for an AI system | Evidence to keep |
|---|---|---|
| Territorial scope | Confirm whether EU individuals' data is processed and whether an EU representative is needed | Scope memo per system |
| Lawful basis | Separate basis for training, testing and use; Article 9 condition for special category data | Lawful basis register, balancing tests |
| Purpose limitation | Compatibility assessment before reusing existing data for training | Signed compatibility assessment |
| Minimisation | Justify each field; pseudonymise or anonymise where possible | Data inventory and field rationale |
| Transparency | Explain AI use and the logic of automated decisions in plain language | Privacy notices, explanation templates |
| DPIA | Complete before high-risk processing; prior consultation if residual risk stays high | DPIA with review date |
| Automated decisions | Meaningful human review or a valid Article 22 exception with safeguards | Review procedure, override logs |
| Data subject rights | Handle access, erasure and objection across datasets, logs and outputs | Rights procedure per system |
| Processors | Article 28 terms with every AI vendor; check training use of your data | Signed DPAs, sub-processor lists |
| Transfers | Chapter V mechanism for every non-EU flow | Transfer register and assessments |
| Security and records | Article 32 controls and Article 30 records covering AI processing | Records of processing, security review |
our offer
Our GDPR and DPIA for AI Assessment Offer
GDPR and DPIA for AI Compliance Assessment (4 to 6 Wk) is one of the assessment offers we have submitted to Microsoft Marketplace. It covers automated decision-making under Article 22, DPIAs under Article 35, security under Article 32 and cross-border data transfers; assessment evidence for your counsel and DPO can be prepared on request. We are a governed-AI consultancy for regulated industries, and a Microsoft Solutions Partner for Cloud & AI Platforms · Partner ID 7036589.
We are not a law firm and do not give legal advice; we do the technical and evidence work that counsel needs. We do not yet have a named, published GDPR case study. Engagements are scoped and priced after a short discovery call.
Related resources
Continue exploring
Straight answers
Frequently asked questions about GDPR Compliance AI Guide for US Firms With EU Exposure
Does the GDPR apply to a US company using AI?
It can. The GDPR applies to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour there, and to any EU establishment you have. If your AI system processes personal data about those people, for training, prompts or decisions, the GDPR applies to that processing regardless of where your servers or headquarters are.
Do we need a DPIA for AI?
You need a DPIA whenever processing is likely to result in a high risk to individuals, and many AI uses meet that test: profiling with significant effects, large-scale use of health or other special category data, and large-scale systematic monitoring of public areas. Supervisory authorities publish lists of processing that requires a DPIA; check the list for your authority. If an AI system scores, ranks or profiles people, plan on doing one before go-live.
Can we train an AI model on customer data we already hold?
Not automatically. Purpose limitation means data collected for one purpose needs a compatibility assessment, or a new lawful basis, before it is used to train a model. Health and other special category data also need an Article 9 condition. Minimise the fields, pseudonymise where you can, update your privacy notices and document the decision before the training run.
Does putting a human in the loop solve Article 22?
Only if the review is meaningful. The reviewer must have the authority to change the outcome, the information to judge it and the time to do so. Rubber-stamping model recommendations still counts as a solely automated decision. Even with meaningful review, transparency obligations about how the system works and the right to object to profiling still apply.
Is our AI vendor a processor or a controller?
If the vendor only processes your data on your instructions, it is a processor and needs an Article 28 contract. If it also uses your prompts, files or outputs for its own purposes, such as improving its models, it may be a controller for that use. Read the data use terms, prefer configurations that exclude training on your data, and record the answer.
How do the GDPR and the EU AI Act fit together?
They are separate laws that apply side by side. The AI Act regulates AI systems by risk category; the GDPR regulates personal data. An AI system that processes personal data must meet both. Much of the evidence overlaps, including risk assessment, documentation, human oversight and data governance, so it is efficient to build it once and map it to both.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call