GDPR and AI: your personal data and AI assistants
The GDPR is the European Union's data protection law, in force since May 25, 2018. It also covers AI tools whenever they handle information about people, including what you type into a chatbot.
Data as of October 22, 2026
Key figures
| Level | Beginner |
|---|---|
| Origin | 2016 |
| Introduced by | Union européenne, règlement (UE) 2016/679 du 27 avril 2016, applicable depuis le 25 mai 2018 |
The GDPR in two sentences
The General Data Protection Regulation (Regulation (EU) 2016/679) was adopted on April 27, 2016 and has applied directly in every EU member state since May 25, 2018. It sets the rules for collecting and using personal data, meaning any information that can identify a person: name, email, voice, photo, customer ID and so on.
It wasn’t written with AI in mind, but it fully applies as soon as an AI tool processes this kind of information.
Where the GDPR meets AI
- When you chat with an assistant. What you type may be stored by the provider and, depending on your settings, used to improve its models. The assistant’s memory also keeps information about you.
- When a model is trained. Training data scraped from the web can include personal data. France’s data protection authority, the CNIL, has published recommendations on applying the GDPR to AI development (in French), and every EU country has its own regulator.
- When a decision affects you. The GDPR restricts fully automated decisions with a significant effect on you, such as a loan refusal, and provides in particular for the right to ask for human review.
A real-world work example
An HR assistant wants an AI assistant to summarize résumés. Good questions to ask first: is the tool approved by the company? Will the résumés be stored or used for training? Have candidates been informed? Removing names and contact details before uploading already cuts the risk significantly. The Can I trust an agent with this? tool helps you spot this kind of sensitive situation.
Common misconceptions
- « It’s public online, so I can use it however I like. » Wrong: publicly available data is still personal data.
- « The GDPR bans AI. » No. It sets rules (clear purpose, data minimization, security, informing people), not a ban.
- « My chats are private by default. » It depends on the plan and settings; read the privacy policy and opt out of training if the option exists.
A law that may change
On November 19, 2025, the European Commission proposed targeted changes to the GDPR as part of a « digital omnibus » simplification package, including rules framing the use of personal data to train AI models. As of October 22, 2026, that part was still under negotiation, so the current rules apply. The GDPR also works alongside the EU AI Act.
Related terms
- EU AI Act · The European law that regulates AI systems according to their level of risk, with bans and transparency duties.
- Training data · The examples (text, images, audio and more) an AI model learns from; they shape what the model knows and where it goes wrong.
- AI memory · A feature that lets an AI assistant remember facts about you from one conversation to the next.
- AI ethics · The principles for designing and using AI in a way that is fair, transparent and respectful of people and their rights.
- AI assistant · A consumer app such as ChatGPT, Claude or Gemini that answers, writes, summarizes and helps with everyday tasks using AI.
Try it
Full glossary
Frequently asked questions
Can I paste a customer's details into ChatGPT?
It depends on your employer's rules, the plan you use and the contract with the provider. To be safe, don't paste identifiable personal data without internal approval. If in doubt, ask your organization's data protection officer (DPO).
Can I ask an AI company what it knows about me?
Yes. Under the GDPR, people have a right of access to their data, plus rights to rectification, erasure and objection under certain conditions. Providers usually explain how to make a request in their privacy policy.
Does the GDPR apply to US or Chinese AI companies?
Yes, when they offer their services to people in the European Union. That's what allows European regulators to oversee assistants built outside Europe.
What's the difference between the GDPR and the EU AI Act?
The GDPR protects personal data, whatever the technology. The AI Act regulates AI systems themselves according to their level of risk. Both apply at the same time.
Data sources
Data as of October 22, 2026
Report an error
Does a figure, a date or a fact look wrong? Tell us: every report is checked.