GDPR (General Data Protection Regulation)

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is a European Union legal framework for Data Protection, adopted in 2016 and applicable from 25 May 2018. In Artificial Intelligence and Machine Learning, it governs how Data Controllers and Data Processors handle Personal Data, requiring lawful processing, transparency, Data Minimization, and Purpose Limitation. Article 22 principally provides a right not to be subject to solely Automated Decision-Making producing legal or similarly significant effects, subject to exceptions and safeguards; Articles 13–15 require meaningful information about the logic involved in relevant automated decision-making, rather than establishing a general, standalone Right to Explanation of every automated decision. The regulation also restricts processing of Biometric Data used to uniquely identify individuals and requires Data Protection Impact Assessments where processing is likely to result in a high risk to individuals’ rights and freedoms, considering its nature, scope, context, and purposes—not merely because an Algorithm is labelled high-risk. Compliance requires appropriate technical and organisational measures and adherence to applicable rules, supported by Data Governance; Anonymization is not universally mandatory, and its use alone does not establish the lawfulness of developing Large Language Models or other Data Science applications. Enforcement can include substantial financial penalties. Its territorial scope covers relevant processing connected to establishments in the European Economic Area and can extend to organizations outside it when Article 3 conditions are met, notably offering goods or services to people there or monitoring their behaviour there; companies such as Google, Meta, and OpenAI are subject to applicable obligations where their processing falls within that scope.