The GDPR (General Data Protection Regulation) is the European Union's data protection law, in force since 25 May 2018. It governs how the personal data of individuals in the EU is processed and establishes principles such as lawfulness, purpose limitation, data minimisation, transparency and the right to erasure. Infringements can result in administrative fines of up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher.
As AI services become more widespread and capable, the GDPR grows in importance. Retrieval-Augmented Generation (RAG) systems index company documents, e-mails and customer records and pass them to a model as context. Chatbots, summarisation and classification tools, and customer data processing services (CRM, support tickets, call recordings) handle personal data at scale, often through cloud-based third-party models.
AIGDPR is the intersection of artificial intelligence and the GDPR, and its risks are concrete: personal data used for model training or fine-tuning without a legal basis or beyond its original purpose; prompts and responses retained in logs for longer than necessary; transfers of data to model providers outside the EU; rights to erasure and rectification that cannot be applied to vector indexes and model outputs; RAG systems that exceed access boundaries and expose personal data to unauthorised users; automated decision-making under Article 22; and missing data processing agreements or data protection impact assessments (DPIA). Our team consists of experts with more than 25 years of experience in artificial intelligence, management and GDPR compliance.