GDPR
Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation)
Official text (opens in a new tab)Draft – legal and case law references not yet verified
In Plain Language
The EU's core data protection law. Any AI system that uses personal data needs a legal basis, must respect principles like purpose limitation and data minimisation, and must let people exercise rights such as access and objection. It also limits decisions made solely by automated means that significantly affect people.
Key Dates
- Entry into force
- Applies
Verify Dates and status last checked 29 October 2026. Later amendments may have changed them; check the official text before relying on them.
Key Articles for AI
| Art. 5 | Core principles: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy. |
|---|---|
| Art. 6 | Legal bases for processing. |
| Art. 9 | Special categories of data such as biometrics and health. |
| Arts. 13–15 | Information and access rights, incl. meaningful information about automated logic. |
| Art. 22 | Limits on solely automated decisions with legal or similarly significant effects. |
| Art. 25 | Data protection by design and by default. |
| Art. 35 | Data protection impact assessment for high-risk processing. |
Use Cases Citing This Law
Related Sources
General Data Protection Regulation (GDPR) (opens in a new tab)
EU rules on personal data, including rights around automated decision-making and profiling that apply to many AI systems.