Personal data in AI: what GDPR asks of the design.
GDPR is not new, but AI puts pressure on it. Training data, health records and automated decisions all raise questions that are cheaper to answer in the design than after launch.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Any organisation processing personal data of people in the EU
- AI projects that train on, or make decisions about, people
- Healthcare and life science, where health data gets extra protection
- 25 May 2018 Applies.
- Pending The Commission proposed changes as part of a digital omnibus in November 2025. Not adopted when checked.
Three questions for every AI system that touches people.
Is it special-category data?
Health data is a special category. Processing it is prohibited unless a specific exception applies.
Do you need a DPIA?
A data protection impact assessment is required before high-risk processing, including large-scale health data and automated evaluation with significant effects.
Is a decision fully automated?
People have the right not to be subject to decisions with significant effects made solely by automated processing, with narrow exceptions and a right to human review.
Where does the data go?
Where data is stored and processed, and who can reach it, is a design decision. Private and EU-hosted AI keep the answer simple.
From requirement to working system.
Privacy by design is mostly architecture: what data a system needs, where it lives, and where a person stays in the loop.
- Data architecture that collects and keeps only what is needed
- Input for DPIAs from the engineering side
- Human review built into decisions that affect people
- Private AI environments that keep personal data in your control
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation