Scope and obligations

Foundational EU personal-data protection regulation. Most-cited European instrument PW catalogues at the AI-governance boundary — every CNIL / Garante / AEPD / BfDI / DPC enforcement action against an AI system (Clearview, ChatGPT, Replika, automated-hiring complaints) invokes GDPR Arts. 5/6/9/22/35. Art. 22 (automated individual decision-making + profiling) is the load-bearing provision that interacts with EU AIA Art. 26(11) deployer use of AI-system output for decisions concerning natural persons. Art. 35 (DPIA) partially overlaps EU AIA Art. 27 FRIA; the EDPB is finalising a joint EDPB-AI-Office guideline on the AIA-FRIA / GDPR-DPIA interplay through 2026. Art. 9 (special-category processing) interacts with EU AIA Art. 5(1)(c)(d)(g) prohibitions on social scoring + emotion recognition in workplace + untargeted facial-image scraping. Enforced by national Data Protection Authorities; the European Data Protection Board (EDPB, formerly Art. 29 Working Party) coordinates one-stop-shop + Article 65 binding-decision procedures across DPAs.

General Data Protection Regulation (GDPR) addresses 4 contested AI-governance topics explicitly,.

Topics governed

• governs
  Biometric Identification— Art. 9 special-category processing (biometric data for unique identification); Art. 22 ADM with safeguards
• governs
  Transparency Obligations— Arts. 12-14 (information to data subjects); Art. 13(2)(f) + 14(2)(g) meaningful information about ADM logic; Art. 22(3) suitable safeguards
• governs
  Individual Redress— Art. 77 DPA complaint; Art. 79 effective judicial remedy; Art. 80 collective representation by NGOs; Art. 82 right to compensation; Art. 83 administrative fines
• governs
  Training-Data Rights— Art. 5(1)(b) purpose limitation; Art. 6 lawful basis; Art. 9 special-category overlay for sensitive training data; Art. 5(1)(c) data minimisation

Cross-jurisdiction comparison

How peer instruments treat the topics General Data Protection Regulation (GDPR) governs.

°= industry self-imposed voluntary framework. Comparing a voluntary code's "governs" tint with a binding regulation's "governs" tint flattens the legal-force distinction; use the instrument-page banner for the operative status of each.

How to cite this article

Policy Window. (2016). General Data Protection Regulation (GDPR) [Wiki article — Instrument]. https://policywindow.org/wiki/gdpr

Policy Window. 2016. "General Data Protection Regulation (GDPR)." Wiki article (Instrument). https://policywindow.org/wiki/gdpr.

@misc{policywindow-gdpr,
  title  = {General Data Protection Regulation (GDPR)},
  author = {Policy Window},
  year   = {2016},
  howpublished = {Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88 (CELEX:32016R0679; ELI:http://data.europa.eu/eli/reg/2016/679/oj); applied from 25 May 2018.},
  url    = {https://policywindow.org/wiki/gdpr},
  note   = {Primary source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679}
}

Related instruments

• EU AI Act · EU
• Interim Measures for Generative AI Service Management · CN
• OECD AI Principles (Recommendation) · OECD
• Council of Europe Framework Convention on AI · council_of_europe
• NIST AI RMF Generative AI Profile · US
• India Digital Personal Data Protection Act + AI Advisory (MEITY) · IN
• Brazil AI Bill (PL 2338/2023) · BR
• EU General-Purpose AI Code of Practice · EU

References

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88 (CELEX:32016R0679; ELI:http://data.europa.eu/eli/reg/2016/679/oj); applied from 25 May 2018.
2. Art. 9 special-category processing (biometric data for unique identification); Art. 22 ADM with safeguards
3. Arts. 12-14 (information to data subjects); Art. 13(2)(f) + 14(2)(g) meaningful information about ADM logic; Art. 22(3) suitable safeguards
4. Art. 77 DPA complaint; Art. 79 effective judicial remedy; Art. 80 collective representation by NGOs; Art. 82 right to compensation; Art. 83 administrative fines
5. Art. 5(1)(b) purpose limitation; Art. 6 lawful basis; Art. 9 special-category overlay for sensitive training data; Art. 5(1)(c) data minimisation