A model’s training method does not determine whether personal-data law applies. The European Data Protection Board’s December 2024 opinion emphasizes case-by-case assessment of AI models and their data processing.
Is the model anonymous?
Anonymity is not established simply because the original records are no longer visible as a spreadsheet. The EDPB considers the possibility of directly or indirectly extracting personal data from the model and of obtaining such data through queries. Context, mitigations, likelihood and technical assessment matter. A claim that a model is anonymous should be supported by documented tests and a reasoned determination, not merely a provider label.
Lawful basis is not one-size-fits-all
GDPR analysis requires a legal basis under Article 6 for processing personal data. Legitimate interests may be relevant to some development or deployment scenarios, but the EDPB describes a structured, case-specific assessment that considers necessity and balancing against individuals’ rights. Consent, where relied upon, has its own requirements. No single lawful basis should be presumed for every generative AI dataset.
Map responsibilities across lifecycle stages
Development, fine-tuning, retrieval, inference and quality review may involve different controllers, processors and purposes. Identify data categories, sources, notices, security controls, retention, access and transfers. A provider’s security documentation cannot replace the deploying organization’s own analysis. Sensitive data and consequential decisions can trigger additional obligations.
Evaluate rights in practice
Consider how people can exercise rights to information, access, correction or erasure where applicable. A deletion request may be harder to fulfill after data has influenced model weights; this is a reason to scrutinize data minimization and whether the processing design is appropriate before collection. Do not claim that all AI-weight deletion requests can be satisfied technically.
Example: internal HR document assistant
Prefer indexing approved policy documents rather than staff medical notes. Enforce access controls before retrieval, prevent unrestricted logging, document retention and route individual rights requests to the controller. Use a privacy impact assessment when indicated by the risk. Review national regulatory interpretation in addition to EU-level materials.
Legal status
The GDPR is binding where applicable; EDPB Opinion 28/2024 is an authoritative regulatory interpretation, not a blanket determination that a particular AI model is legal or illegal. This article is education, not legal advice.
Sources & Further Reading
Guidance varies by jurisdiction and application. This is general education, not legal, medical or other professional advice.