GDPR for AI Developers

What is GDPR?

The General Data Protection Regulation (EU) 2016/679is the world's most comprehensive data privacy law. In force since May 2018, it governs how organisations process personal data of EU and EEA residents. It applies regardless of where the organisation is based — if you process data of EU residents, GDPR applies to you.

The EU AI Act (2024/1689) adds a second layer for high-risk AI systems (medical, credit scoring, recruitment, critical infrastructure). GDPR compliance is a prerequisite for AI Act compliance — this guide covers GDPR. The AI Act adds obligations on top.

Who is affected?

GDPR applies to any organisation that processes personal data of EU/EEA residents, regardless of where the organisation is established. A company in India, the US, or Singapore building an AI product used by EU customers is fully in scope.

AI systems are broadly in scope because they process personal data at every layer: user input (prompts), LLM inference (the API call itself is a processing operation), tool calls, responses, and any fine-tuning datasets. Sending EU personal data to a US-based LLM API is simultaneously a disclosure (Art. 4(2)) and potentially a cross-border transfer (Art. 44).

Art. 6 — Lawful basis

Every processing of personal data requires a lawful basis. There are six. For most commercial AI applications, the relevant ones are:

Art. 7 — Consent mechanics for AI

When consent is your lawful basis, it must be: freely given (not bundled with service terms), specific (per-purpose, not "AI processing" in general), informed (clear explanation of AI processing and LLM vendors used), and unambiguous (explicit opt-in, no pre-ticked boxes). Withdrawal must be as easy as granting.

import governor

# Record GDPR consent before processing EU personal data
governor.consent.grant(
    data_subject_id="USR-EU-4821",   # never store raw email — hash it
    purpose="credit_risk_assessment",
    legal_basis="explicit_consent",
    data_categories=["IBAN", "CREDIT_CARD", "EMAIL"],
    locale="eu",
    channel="web_app",
    consent_version="3.2",
)

# Verify before every AI processing call
result = governor.consent.verify(consent_id)
if not result.valid:
    raise PermissionError(f"Cannot process: {result.reason}")

# On withdrawal — must stop ALL processing immediately
governor.consent.withdraw(consent_id)

Art. 5(1)(c) + Art. 25 — Data minimisation & privacy by design

Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes." Article 25 (privacy by design) requires that data minimisation be the default — not something you enable with a flag.

For AI systems, this is one of the most commonly violated principles. Passing full EU personal data records to an LLM when only a subset is needed for the task violates Art. 5(1)(c). governor.wrap(client, locale='eu') enforces this technically — PII is stripped before the prompt leaves your network.

import governor, openai
from governor_tracer import GovernorTracer

tracer = GovernorTracer(agent_id="eu-credit-agent")
client = governor.wrap(
    openai.OpenAI(),
    locale="eu",      # activates IBAN, UK_NIN, EU_PASSPORT, CREDIT_CARD detection
    tracer=tracer,    # logs every call to the audit trail
)

# IBAN and credit card are redacted before reaching OpenAI.
# The audit trail records pii_types=["IBAN"] with pii_redacted=True.
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{
        "role": "user",
        "content": "Credit risk for IBAN GB29NWBK60161331926819, card 4532015112830366"
    }]
)

EU PII types Governor detects

Art. 13–14 — Transparency notice

At collection time (or within one month if data is obtained indirectly), data subjects must receive a privacy notice covering: the controller's identity, purposes and legal basis for processing, categories of data, recipients (including LLM API vendor categories), retention periods, all data subject rights, and — critically — the existence of automated decision-making with meaningful information about the logic involved.

Art. 15–20 — Data subject rights

Art. 22 — Automated decision-making

Article 22 is the most important GDPR provision for AI systems. Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects — credit decisions, insurance premiums, recruitment screening, medical triage, performance evaluation.

If your AI system makes such decisions, you must: (a) offer a human review mechanism, (b) allow the data subject to contest the outcome, (c) provide a meaningful explanation of the logic involved. "The model said so" is not a meaningful explanation.

from governor_tracer import GovernorTracer

tracer = GovernorTracer(agent_id="eu-loan-agent")

with tracer.run() as run:
    run.llm_call("openai", "gpt-4o", redacted_prompt, response)
    run.decision(
        reason="Credit score 680, income verified, no defaults in 36 months",
        outcome="approve",
        confidence=0.89,
    )

    # Art. 22 — human review for significant automated decisions
    run.human_checkpoint(
        question="Approve €15,000 loan for applicant EU-8821?",
        approved=True,
        reviewer_id="maria.s.credit.officer",  # reviewer identity
        notes="Verified income documents manually.",
    )

# The audit trail now proves:
# 1. What logic led to the decision (decision event)
# 2. A human reviewed and approved it (human_checkpoint event)
# 3. The chain is cryptographically intact (run.verify())

Art. 32 — Technical security safeguards

Article 32 requires "appropriate technical measures" including pseudonymisation, encryption, confidentiality and availability guarantees, and regular testing. For AI systems, the primary Art. 32 safeguard is PII redaction before LLM API calls— because sending EU personal data unredacted to an external API is itself a security gap, regardless of what the vendor's DPA says.

Art. 33–34 — Breach notification

A breach of EU personal data must be notified to the supervisory authority within 72 hours of discovery (Art. 33). If the breach is likely to result in high risk to data subjects (e.g. exposed financial or health data), affected individuals must also be notified without undue delay (Art. 34).

For AI systems, inadvertent PII leakage through an LLM prompt — for example, an un-redacted IBAN sent to OpenAI's servers — likely constitutes a breach. The 72-hour clock starts at discovery, not at the time of the leak. A structured audit trail makes breach scope determination (exactly whose data, exactly what type) a query, not a forensic investigation.

Art. 35 — Data Protection Impact Assessment

A DPIA is mandatory before processing likely to result in high risk to data subjects. Supervisory authorities publish lists of processing types that always require a DPIA. For AI systems, these commonly include:

The DPIA must assess necessity and proportionality, risks to data subject rights and freedoms, and planned mitigating measures. If residual risk remains high after mitigations, you must consult your supervisory authority before proceeding.

Art. 44–49 — Cross-border transfers to LLM APIs

Sending EU personal data to LLM APIs hosted outside the EEA is a cross-border transfer subject to Chapter V. The primary mechanisms are:

Implementation: EU PII detection in production

# pip install pygovernor
import governor

# Detect EU entities
entities = governor.detect(
    "IBAN: GB29NWBK60161331926819, NIN: AB123456D",
    locale="eu",
)
# [Entity(type='IBAN', ...), Entity(type='UK_NIN', ...)]

# Redact — token replacement (default)
result = governor.redact("Card: 4532015112830366", locale="eu")
result.text    # "Card: [CREDIT_CARD]"
result.count   # 1

# Redact — partial mask (GDPR-friendly, preserves last 4)
result = governor.redact("Card: 4532015112830366", locale="eu", replacement="mask")
result.text    # "Card: XXXX-XXXX-XXXX-0366"

# IBAN mask preserves first 4 chars (country + check) and last 4 digits
result = governor.redact("IBAN GB29NWBK60161331926819", locale="eu", replacement="mask")
result.text    # "IBAN GB29XXXXXXXXXXXXXX6819"

// npm install governor-sdk
import { detect, redact, wrap, GovernorTracer } from 'governor-sdk';

// Detect EU entities
const { entities } = detect("NIN: AB123456D, IBAN: GB29NWBK60161331926819", "eu");

// Redact with mask
const { text } = redact("Card 4532015112830366", "eu", "mask");
// "Card XXXX-XXXX-XXXX-0366"

// Wrap + trace
const tracer = new GovernorTracer("eu-credit-agent");
const client = wrap(new OpenAI(), { locale: "eu", tracer });

Implementation: Art. 30 Records of Processing

Article 30 requires controllers (250+ employees, or non-occasional processing) to maintain Records of Processing Activities (RoPA). For AI systems, this means documenting: each agent's processing purposes, categories of data subjects, categories of personal data, LLM vendor names and locations, retention periods, and security measures.

The Governor Agent Tracer generates this automatically — every run logs the fields accessed, the purpose, the LLM provider, and a timestamp. The compliance engine aggregates these into an Art. 30 report on demand.

from governor_tracer import GovernorTracer

tracer = GovernorTracer(agent_id="eu-loan-agent-v3")

with tracer.run() as run:
    run.data_access(
        source="eu_customer_db",
        fields_accessed=["iban", "credit_score", "income"],
        purpose="mortgage_assessment",
        data_principal_id="EU-CUST-7741",  # hashed before storage
    )
    run.llm_call(
        provider="openai",
        model="gpt-4o-mini",
        prompt="[IBAN] applicant, score 710",  # PII already redacted
        response="Low risk. Recommend approval.",
        pii_types=["IBAN"],
        redact_pii=True,
    )
    run.decision(
        reason="Score above 700 threshold, no defaults",
        outcome="approve_conditional",
        confidence=0.91,
    )

valid, msg = run.verify()  # cryptographic proof chain is intact

Penalties

GDPR has two penalty tiers. The higher figure or the revenue percentage is applied — whichever is greater. For large companies, the revenue percentage is typically larger.

Notable enforcement actions against AI systems include the Italian DPA ordering ChatGPT offline (March 2023), Clearview AI fines across EU member states (€20M+), and ongoing investigations into LLM training data practices by EDPB.

GDPR compliance checklist for AI systems

Before deploying AI on EU personal data

At runtime

Ongoing