What is GDPR?
Also called General Data Protection Regulation, Regulation (EU) 2016/679.
The General Data Protection Regulation is European Union law governing the processing of personal data, applicable since May 2018. It requires a lawful basis for processing, sets principles such as purpose limitation and data minimization, grants individuals enforceable rights over their data, and applies to organizations outside Europe that target or monitor people within it.
Personal data is defined broadly as any information relating to an identified or identifiable natural person, which reaches beyond obvious identifiers to include online identifiers, device data, and location data. Special categories such as health, biometric, and political data carry stricter conditions. Roles matter throughout: a controller decides the purposes and means of processing, while a processor acts on the controller's documented instructions.
Processing requires a lawful basis, chosen from a defined list that includes consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. Consent is only one option and is often the wrong one for business processing, since it must be freely given and can be withdrawn. The core principles constrain processing regardless of basis: purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
Individuals hold rights including access, rectification, erasure, restriction, portability, and objection, together with provisions concerning decisions based solely on automated processing that produce legal or similarly significant effects. These rights create concrete engineering requirements, because a system must be able to locate and act on one person's data across every store, including backups, indexes, and derived artifacts.
AI systems raise recurring questions under the regulation: whether personal data may be used for training, how erasure applies to information absorbed into model weights or embeddings, how automated decision provisions apply to model-driven outcomes, and how transfers outside the European Economic Area are handled. Several of these remain the subject of regulatory guidance and litigation. Nothing here is legal advice, and specific situations warrant qualified counsel.
Key points
- Applicable since May 2018, with extraterritorial reach
- Personal data is defined broadly, beyond obvious identifiers
- A lawful basis is required, and consent is only one of six
- Individual rights create real engineering requirements
- Training data and erasure questions remain actively debated
In practice
A company receives an erasure request from a former customer. Honoring it requires locating that person's data in the primary database, the search index, the analytics store, conversation transcripts, uploaded files, embeddings derived from those files, and backups, then applying deletion or the documented retention exception to each. Systems designed without a per-person deletion path make this expensive and slow to complete.