Glossary · Rules and compliance
GDPR
GDPR is the General Data Protection Regulation, a European law governing the processing of personal data. It sets obligations for organisations within its scope and gives people rights over their information, including when that information is handled through an AI assistant, agent or other service.
GDPR: the explanation
The GDPR covers activities involving information about people, including collecting, reading, sharing, storing and deleting it. Asking an agent to summarise work emails can therefore involve personal data processing. The responsible organisation needs a defined purpose and an appropriate lawful basis. It also needs to limit the information used and protect it. Selecting an AI product does not settle these requirements by itself, because the assessment depends on what you actually do with the product.
The framework helps establish responsibilities and gives people ways to influence how their information is used. Subject to applicable conditions, rights include access, correction and erasure. When introducing an AI tool, identify who decides the purposes of processing and what role the provider plays. This is particularly useful when several services handle the same request. Official introductory guidance is available from the European Data Protection Board at https://www.edpb.europa.eu/sme_en, including explanations intended for smaller organisations.
Compliance involves more than accepting a checkbox or choosing a European hosting location. Contracts, access permissions, retention periods and any international transfers also matter. Consent is not automatically the right lawful basis. Activities carried out solely within a personal or household setting may fall within an exemption, while the provider can still have obligations of its own. You therefore need to distinguish your circumstances from those of the service and assess the actual flow of information.
A concrete example
You want an assistant to draft replies to customer enquiries. Before connecting it to your inbox, your organisation defines the purpose, checks the lawful basis and reviews the provider’s contract. You restrict the information sent to what the task needs. You also check conversation retention and establish how your organisation would respond if a customer requested access to information concerning them.
Why it matters
The GDPR matters when you compare tools that read email, record meetings or search customer records. A provider’s claim of compliance does not describe every condition of your own use. You need to understand the responsibilities, the information processed and the available controls. These details help determine whether an application can fit the way your organisation handles personal information in practice.
Common misconceptions
- The GDPR does not require consent for every use of personal data, because several lawful bases are available and the appropriate choice depends on the purpose, context and conditions of the processing you plan to carry out.
- Hosting an AI service within the European Union does not automatically make its use GDPR compliant, because location alone does not resolve questions about purpose, security, providers, retention or the rights of the people whose information is processed.
Related terms: rules and compliance
- EU AI Act
- The EU AI Act is a European regulation governing certain artificial intelligence systems and general-purpose AI models.
- personal data
- Personal data is information relating to an identified or identifiable living person.
Where this site covers it
The term appears on 159 pages of this site. A few of them:
- AI Act: a compliance checklist for businesses using AI agents and tools Guide
- Writing your company’s AI use policy: what to include, sample rules, and rollout Guide
- Deploying AI agents in business: use cases, selection, pilots, governance, and measurement Guide
- AI agents and the GDPR: what data leaves, and where does it go? Article
- AI Act: what changes for AI agents Article
- Run an AI agent in a sandbox Article
- AI agent security: 10 risks and how to protect against them Article
- AI agents for customer service: an honest assessment Article
Go further
Frequently asked questions
Is consent always necessary?
No. Consent is one possible lawful basis. You need to identify the basis that fits the processing and satisfy its requirements. The French data protection authority explains the distinction here: https://www.cnil.fr/fr/les-bases-legales/consentement.
Can you request deletion?
A right to erasure exists, but conditions and exceptions apply. The organisation must assess the circumstances. For example, some information may need to be retained to meet a legal obligation or establish, exercise or defend legal claims.
Can overseas providers be covered?
Yes, depending on their activities. GDPR scope is not determined only by where a provider is established. Certain activities directed at people in the European Union can also fall within its scope under the regulation’s criteria.
Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score