GDPR AI Compliance: Data Protection for AI Systems

Article 22(1) GDPR gives data subjects the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects or similarly significantly affects them. For AI systems this means: scoring models, credit decisions or applicant screening tools that decide without human review are generally prohibited. Exceptions apply only where there is explicit consent, contractual necessity or a legal authorization — and even then organizations must guarantee the right to contest the decision, obtain human intervention and express one's point of view (Article 22(3)).

A DPIA under Article 35 GDPR is mandatory whenever AI processing is likely to result in a high risk to the rights and freedoms of individuals. Supervisory authorities routinely consider this threshold met for AI, especially where there is: profiling and automated decision-making, processing of special categories of personal data, systematic monitoring of public areas, or innovative technology used at scale. Since August 2025, Article 27 of the EU AI Act additionally requires a fundamental rights impact assessment (FRIA) for high-risk AI systems.

The GDPR regulates the protection of personal data in any processing — including by AI. The EU AI Act regulates AI systems themselves based on their risk level: prohibited practices, high-risk systems, limited transparency obligations and minimal risk. Both frameworks apply in parallel and their penalties stack: up to EUR 20 million (GDPR) plus EUR 35 million (AI Act). Organizations must therefore meet both data protection requirements (legal basis, DPIA, data subject rights) and product-safety-oriented AI obligations (risk classification, documentation, human oversight).

Profiling under Article 4(4) GDPR covers any automated processing of personal data to evaluate personal aspects — such as work performance, economic situation, health, interests or behavior. With AI systems, profiling occurs when algorithms analyze user behavior, calculate risk scores or make predictions about individuals. It becomes unlawful when the decision is solely automated and produces legal or similarly significant effects (Article 22(1)), when there is no valid consent, or when special categories of data are processed without explicit consent (Article 22(4)).

Articles 13 and 14 GDPR require controllers to inform data subjects about automated decision-making including profiling. Specifically, organizations must provide meaningful information about the logic involved, the significance and the envisaged consequences of the processing. For AI systems this means: clear explanations of which data the model uses, how decisions are reached and what effects can be expected. The EU AI Act adds labelling obligations: users must know they are interacting with an AI system, and deepfakes or AI-generated content require disclosure.