GDPR & AI Compliance

Overview

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection framework that came into effect in May 2018. It establishes strict rules for how organizations collect, store, process, and transfer personal data of EU residents. For AI and machine learning teams, GDPR introduces unique challenges because training data often contains personal information, and model outputs can inadvertently reveal details about individuals in the training set.

GDPR applies to any organization processing the personal data of EU residents, regardless of where the organization is based. This extraterritorial scope means that AI teams worldwide must consider GDPR when their models are trained on data that includes information about people in the EU. The regulation requires a lawful basis for processing and sets principles of data minimization and purpose limitation. It also gives data subjects rights that include access, rectification, erasure and objection, plus specific protections around automated decision-making.

For AI practitioners, GDPR's rules on automated decision-making (Article 22) and the transparency obligations in Articles 13 to 15 are particularly significant. Organizations must be able to give meaningful information about the logic involved in automated decisions that affect individuals, maintain records of processing activities, and apply technical and organizational measures that protect personal data across the AI lifecycle, from data collection through model training, deployment and eventual retirement.

AI-Specific Requirements

GDPR imposes several specific requirements on AI systems that process personal data. Article 22 grants individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. This means organizations must implement human oversight mechanisms for AI-driven decisions affecting employment, credit, insurance, or similar consequential outcomes. Additionally, data controllers must provide meaningful information about the logic involved in automated decision-making.

The regulation's data minimization principle (Article 5(1)(c)) requires that only personal data that is adequate, relevant, and limited to what is necessary for the specified purpose be processed. For AI training, this means teams cannot simply aggregate all available data; they must carefully curate datasets to include only what is strictly necessary for the model's intended function. Purpose limitation further restricts the reuse of personal data for training purposes beyond its original collection intent. The European Data Protection Board's Opinion 28/2024 adds that a model trained on personal data cannot be assumed to be anonymous: whether personal data can be extracted from it has to be assessed case by case.

Data Protection Impact Assessments (DPIAs) are mandatory under Article 35 for processing activities that are likely to result in a high risk to the rights and freedoms of individuals. Most AI systems that process personal data at scale will trigger this requirement. DPIAs must describe the processing operations, assess the necessity and proportionality, evaluate risks to data subjects, and outline measures to address those risks. Organizations must also maintain detailed records of processing activities under Article 30, covering what data is processed, for what purpose, and who has access.

How Ertas Helps

Ertas Studio trains models on Ertas's cloud GPUs, so the dataset you train on is uploaded to Ertas and stored so runs can be repeated. If that dataset contains personal data, the upload is part of your processing and needs a lawful basis and data processing terms agreed with us first. For most projects the simpler route is to minimize before upload: pseudonymize or anonymize where the task allows, and keep only the fields the model needs. Data Craft, Studio's dataset builder, lets you edit each example and track its approval status before training, and you can delete an uploaded dataset when its purpose ends.

The trained model is yours. Export it as GGUF or safetensors and run it in your own environment, and the personal data in prompts and outputs at inference time never reaches Ertas. The exported file stays the same until you retrain, so the version you assessed in your DPIA is the version in production. If you would rather not operate it yourselves, the adaptive model endpoint and enterprise builds can run the model in your own cloud or on-premise, as well as Ertas-managed.

The GDPR obligations themselves stay with you as controller: the lawful basis, the DPIA, records of processing, data subject requests, Article 22 safeguards, and the security of the environment where the model runs. Following the EDPB's opinion, assess whether personal data could be extracted from your trained model before you treat it as anonymous.

Compliance Checklist