AI and the GDPR – processing personal data in AI systems
AI systems often process personal data – in training, deployment and daily operation. We help reconcile the requirements of the GDPR and the AI Act.
Scope of the analysis
- Legal basis for processing in training and use of the system.
- Information obligations towards data subjects.
- Automated decision-making and profiling (Article 22 GDPR).
- DPIA and its link with the AI Act fundamental rights impact assessment.
- Data minimisation, retention periods and security.
- Data subject rights, including access and objection.
Two regimes, one set of documents
The GDPR and the AI Act apply in parallel. We prepare documentation so that a single analysis covers both and teams do not duplicate work.
Frequently asked questions
Does deploying AI require a data protection impact assessment?
Often, yes. The GDPR requires a DPIA where processing – in particular using new technologies – is likely to result in a high risk to individuals (Article 35 GDPR). The Polish DPA has published a list of processing operations requiring a DPIA.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.