The General Data Protection Regulation is the European Union's comprehensive data protection and privacy law, enacted in 2016 and enforced starting May 2018. GDPR applies to any organization handling personal data of EU residents, regardless of where the organization is located, making it effectively a global standard.
Core GDPR requirements include explicit user consent for data processing, the right to access and delete personal data, breach notification within 72 hours, and strict conditions on transferring personal data outside the EU. Penalties for violations can reach 4 percent of global annual revenue, which has made GDPR compliance a board-level concern at every multinational.
For AI deployment, GDPR creates specific challenges. Training models on personal data requires a lawful basis, which is often difficult to establish for large-scale web-scraped corpora. The "right to be forgotten" interacts awkwardly with trained model weights that cannot be selectively modified. The EU AI Act, effective in phases through 2026-2027, extends these concerns with AI-specific requirements layered on top of GDPR.