GDPR AI: Definition and Examples

GDPR AI refers to the intersection between the General Data Protection Regulation (GDPR), which came into force in May 2018 in the European Union, and artificial intelligence technologies. This regulatory framework imposes strict obligations on organizations that use AI to process personal data, particularly regarding transparency, consent, and data minimization.

Concretely, the GDPR requires that any AI system processing personal data respects several fundamental principles: lawfulness of processing, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality. Article 22 of the GDPR is particularly relevant to AI, as it grants individuals the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects them.

The stakes are significant for prompt engineering practitioners and AI developers. When designing prompts that process personal data — for example, to personalize responses, analyze behaviors, or generate profiles — it is imperative to ensure that the processing complies with the GDPR. This includes carrying out Data Protection Impact Assessments (DPIAs) for high-risk processing.

Since 2024, the GDPR has been complemented by the European AI Act, which adds a specific regulatory layer for AI systems. Together, these two regulations form a comprehensive framework that requires organizations to document their AI models, ensure the explainability of algorithmic decisions, and allow users to exercise their rights of access, rectification, and erasure over the data used by these systems.