AI and GDPR
- Art. 5, 6, 22, 35 DSGVO Open in the law texts
- EDPB Stellungnahme 28/2024
What does the GDPR require when an AI system processes personal data? Legal basis per phase, Art. 9 data, automated decisions, minimisation, accuracy, transparency, data subject rights, DPIA, processors and third-country transfers.
The AI Act leaves the GDPR untouched. As soon as an AI system processes personal data – in training, inputs or outputs – all GDPR principles and duties apply. This checklist gathers the points that typically remain open with AI, following the German DSK guidance and EDPB Opinion 28/2024.