Data protection and privacy

Overview

AI systems consume and produce personal data, which brings data protection duties: a lawful basis, limits on purpose, accuracy, security and rights for individuals. Many AI projects need a data protection impact assessment before they start.

Key risks

• No lawful basis or consent
• Using data beyond its purpose
• Keeping data too long
• Cross-border transfers through vendors

What to do now

• Map personal data used in AI.
• Minimize and set retention limits.
• Run impact assessments where needed.
• Plan breach response.

Questions to ask

• What personal data does the system use, and why?
• What is our lawful basis, and have we told people?
• Have we done an impact assessment for risky uses?
• How do people exercise their rights over AI-assisted decisions?
• How long is data kept, and where is it processed?

Related tools

• Impact assessment builder
• Incident toolkit

Region rules: EU · US · UK · India · Global standards.

Reviewed 3 Oct 2026. Sources: European Commission: AI Act overview.