GDPR Compliance
for AI Systems

GDPR applies to AI systems that process personal data falling within the territorial scope of Article 3 (Article 3(1) establishment in the Union, Article 3(2)(a) goods or services to data subjects in the Union, or Article 3(2)(b) monitoring of behaviour in the Union). Three groups of articles drive most AI obligations: Article 22 (automated decision-making with significant effects), Article 35 (Data Protection Impact Assessments for high-risk processing), and the lawful-basis requirements of Articles 6 and 9. AI systems also trigger transparency requirements under Articles 13 and 14 when personal data is collected.

Article 22 grants individuals the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects them. Article 22(2) sets narrow exceptions: contractual necessity (a), EU or Member State law (b), and explicit consent (c). For decisions taken under (a) or (c), Article 22(3) requires safeguards including human intervention, the right to express a view, and the right to contest. Article 22(4) restricts use of Article 9 special-category data unless Article 9(2)(a) or (g) applies.

Article 35 requires a DPIA when processing is likely to result in a high risk to individuals’ rights and freedoms. The EDPB-endorsed WP248 guidelines from the Article 29 Working Party identify nine criteria, including evaluation or scoring, automated decision-making with significant effects, systematic monitoring, large-scale processing, and innovative-technology applications. Many high-risk AI systems under the EU AI Act will also trigger a GDPR DPIA where personal-data processing is likely high-risk.

GDPR governs personal data processing; the EU AI Act governs AI system safety and fundamental rights. They overlap on biometric processing, automated decision-making, bias detection using sensitive data, and individual rights, but compliance with one does not satisfy the other; both apply simultaneously. The EU AI Act explicitly preserves GDPR (see Article 2(7) and Recital 9 of Regulation (EU) 2024/1689).

This is unsettled and case-specific. Common Article 6(1) bases for AI training: (a) consent under Article 6(1)(a), used for sensitive applications but operationally fragile; (b) legitimate interests under Article 6(1)(f), the most common basis for non-sensitive training, with a documented balancing test; (c) public interest under Article 6(1)(e), only where grounded in applicable EU or Member State law; (d) contract performance under Article 6(1)(b) where narrowly applicable. Special-category data requires an explicit Article 9(2) ground in addition to the Article 6 basis.

Article 35(7) sets the minimum DPIA contents: a systematic description of the envisaged processing operations and purposes; an assessment of the necessity and proportionality; an assessment of the risks to data subjects’ rights and freedoms; and the measures envisaged to address those risks. For AI systems, add data-quality and bias assessment, automated-decision-making analysis, model behaviour assessment, and post-deployment monitoring. The DPIA must precede high-risk processing; refer to the EDPB-endorsed WP248 DPIA guidelines.

Under Articles 22, 13, 14, and 15: the right to know that automated decision-making is taking place; the right to information about the logic involved and the significance of the decision (Articles 13(2)(f) and 14(2)(g)); the right under Article 22(3) to obtain human intervention, express one’s view, and contest the decision; the right of access under Article 15; and rights to rectification (Article 16) and erasure (Article 17) where applicable. National laws may extend these rights further.

Identify the Article 6 lawful basis: typically Article 6(1)(f) legitimate interests with a documented balancing test; consent is operationally fragile because candidates cannot freely refuse. Run an Article 35 DPIA before deploying. Provide transparent information to candidates under Articles 13 and 14, and where Article 22 applies, implement the Article 22(3) safeguards (human intervention, right to express a view, right to contest). In Germany, additional analysis under Article 88 GDPR and the BDSG employment provisions is typically required. Many AI hiring tools also trigger high-risk obligations under EU AI Act Annex III, point 4.

GDPR compliance attaches to how a controller uses a tool with personal data, never to the tool itself. Compliance depends on the concrete role, purpose, data, safeguards, and Article 6 lawful basis, plus Article 28 processor agreements, Article 35 DPIA where required, and Articles 13 and 14 transparency. Some tools or uses may not be deployable lawfully at all (for example, AI Act prohibited practices or Article 22(4) restrictions on special-category data). Your controller obligations decide compliance, whatever the tool’s marketing claims.

Modulos automates the governance workflow at the GDPR-AI intersection: Article 35 DPIA documentation, Article 22 automated-decision-making records, Article 6 lawful-basis tracking, data-subject-rights workflows, Article 28 processor due diligence, model documentation, and monitoring records. Controls map across GDPR, the EU AI Act, ISO/IEC 42001, NIST AI RMF, and SOC 2 simultaneously, so one evidence pipeline serves multiple frameworks.

The European Data Protection Board (EDPB) publishes guidelines and opinions at edpb.europa.eu. National Data Protection Authorities (DPAs) issue country-specific guidance: for AI, the French CNIL, the Spanish AEPD, and the UK ICO have particularly substantive guidance. The EU AI Act’s interaction with GDPR is addressed in joint EDPB and European Commission communications, and the published Regulation (EU) 2016/679 is on EUR-Lex.