The European Union’s main data protection law, which governs how organisations collect, use, store and share information about identifiable people. It has applied since May 2018, reaches organisations outside Europe that handle the data of people in the European Union, and allows fines of up to 20 million euros or 4 per cent of worldwide annual turnover, whichever is higher. For AI, it shapes what personal data can be used for training, what people must be told, and when automated decisions about them are allowed.
Technical view
European Union Regulation 2016/679, applicable from 25 May 2018. Processing needs a lawful basis, of which consent, contract and legitimate interests matter most for AI, and must respect principles including purpose limitation and data minimisation. Individuals have rights including access and erasure, Article 22 restricts solely automated decisions with legal or similarly significant effects, and impact assessments are required for high-risk processing. Open questions include whether trained weights contain personal data, how erasure works in a model, and whether web scraping can rest on legitimate interests. In November 2025 the European Commission proposed amendments, including to the definition of personal data. The United Kingdom keeps its own amended version.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.