The impact of the General Data Protection Regulation (GDPR) on artificial intelligence
This scientific foresight study examines the relationship between the General Data Protection Regulation (GDPR) and artificial intelligence. It evaluates how AI technologies and big data intersect with GDPR principles such as purpose limitation, data minimisation, and automated decision-making. The study concludes that AI can be deployed consistently with the GDPR, but recommends expanding guidance to prevent legal uncertainty while protecting fundamental rights.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
European policymakers, researchers, and data protection professionals seeking to understand the regulatory interaction between artificial intelligence and data protection law.
What the document contains
The document addresses the intersection of artificial intelligence and big data with the GDPR, examining legal bases, transparency, data subjects' rights, automated decision-making, and privacy by design.
It does not provide binding legislative text or enforceable new regulations, as it functions solely as an advisory research study and policy assessment.
- The GDPR generally provides meaningful and applicable indications for data protection in the context of AI applications.
- Tensions exist between traditional GDPR principles like purpose limitation and the exploratory nature of machine learning and big data.
- Automated decision-making and profiling under Article 22 present significant compliance challenges and require robust safeguards.
- The GDPR's open-ended and vague clauses create legal uncertainty that can burden small companies and hinder innovation.
- Comprehensive regulatory and technical guidance from data protection authorities is necessary to harmonize AI innovation with compliance.
· Introduction · AI and personal data · AI in the GDPR · Policy options: How to reconcile AI-based innovation with individual rights & social values · References
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
3/5Clear responsibility for AI outcomes
Article 24, on 'Responsibility of the controller', requires the controller to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation
3.7.3
screening score · 2026-10-24
Human Oversight
3/5Humans remain in control of consequential decisions
the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
3.6.3
screening score · 2026-10-24
Privacy
5/5Protection of personal data and private life
This study addresses the relation ship between the General Data Protection Regulation (GDPR) and a rtificial intelligence (AI). After introducing some basic concepts of AI, it reviews the state of the art in AI technologies and focuses on the application of AI to personal data.
1. Introduction
screening score · 2026-10-24
Transparency
4/5Openness about how AI systems work and are used
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used.
3.2.1
screening score · 2026-10-24
Enforcement
4/5Consequences and compliance mechanisms with real force
The authority may also use its investigative and corrective powers. In particular it may (a r t icle 50(2)(d)): order the controller or processor to bring processing operations into compliance with the provisions of this Regulation
3.7.5
screening score · 2026-10-24