What applies today
The General Data Protection Regulation (Regulation (EU) 2016/679) applies to any processing of personal data in AI: collecting training data, training, deploying models, and retrieving documents in RAG. The main reference on AI is EDPB Opinion 28/2024, adopted on 18 December 2024 at the Irish regulator’s request.
| Question | EDPB view |
|---|---|
| Is a model anonymous? | Case by case; it must be very unlikely that the model reveals training data, directly or through queries |
| Can legitimate interest be a legal basis? | Yes, using a three-step test; examples include conversational assistants and AI cybersecurity |
| What factors count? | Whether data was public, what people would reasonably expect, and mitigating measures |
| What if the model was built on unlawfully processed data? | Deployment may be unlawful unless the model was properly anonymized |
What may change
The Commission proposed GDPR changes in the Digital Omnibus on 19 November 2025. This data package is separate from the AI Omnibus, which was adopted in 2026.
- EDPB-EDPS Joint Opinion (11 February 2026): strongly urged against narrowing the definition of personal data; saw no need for a special AI legitimate-interest provision; conditionally welcomed a derogation for incidental, residual sensitive data in AI development.
- Council position (21 October 2026): keeps the current definition of personal data, adds a pseudonymization provision, clarifies the lawful basis for AI processing with safeguards, adds safeguards to the sensitive-data exception, and extends the breach notification deadline.
- Parliament had not adopted its position as of late September 2026. The aim is to finish simplification packages by end-2027.
Separately, the AI Act amendment now allows processing special categories of data to detect and correct bias, with safeguards.
Reuse terms
EUR-Lex content is reusable under Commission Decision 2011/833/EU, with only the Official Journal authentic. We did not verify the EDPB or Council site terms during this check; cite and link them rather than reproducing at length.
Using the GDPR in AI and RAG
- Map legal bases for training, fine-tuning, inference, and retrieval separately.
- Document the legitimate interest test where you rely on it.
- Assess model anonymity with the EDPB factors.
- Keep personal data out of shared RAG indexes unless the basis covers it, and honor deletion requests in indexes.
- Label Omnibus changes as proposals until adopted.
Common mistakes
- Assuming public data is free to use for training.
- Treating models as automatically anonymous.
- Forgetting RAG indexes when handling erasure requests.
- Planning around proposed GDPR changes as if adopted.
Checklist
- Legal basis mapped per AI processing stage
- Legitimate interest assessments documented
- Anonymity assessment for models
- Erasure process covers RAG indexes
- Omnibus status tracked
How AskDona helps
AskDona checks your DPIAs, legitimate interest assessments, and records of processing against GDPR articles and EDPB Opinion 28/2024, citing each source passage.
Run a sample GDPR AI assessment check
AskDona shows the evidence; your privacy team decides.
Editor’s note. This article is general information, not legal advice. Parliament’s status relies on a September 2026 law firm update. The “conditions to check” rating is our first-pass judgment.
FAQ
Can AI be trained on personal data under the GDPR? Possibly, with a valid legal basis such as legitimate interest, assessed case by case per EDPB Opinion 28/2024.
Are AI models anonymous? Only if it is very unlikely that personal data can be extracted from them.
Is the GDPR changing for AI? Changes are proposed in the Digital Omnibus; the Council agreed its position on 21 October 2026, and Parliament has not yet.
Does the GDPR apply to RAG? Yes. Indexing and retrieving personal data is processing.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| EDPB: Opinion on AI models | Opinion 28/2024 points |
| EDPB: Joint Opinion on Digital Omnibus | February 2026 views |
| Council: Position on data rules (21 Oct 2026, PDF) | Council position |
| Heuking: GDPR, AI and cookies (Sep 2026) | Parliament status |
| Commission: AI Omnibus enters into force | Bias-correction processing |