Key GDPR obligations for AI use
Lawful basis: every AI processing activity needs documentation — most commonly legitimate interests, requiring a Legitimate Interests Assessment. Transparency: your privacy notice must describe what AI tools process personal data, for what purposes, and what rights individuals have. Automated decision-making: Article 22 gives individuals rights against solely automated decisions with significant effects. DPIAs: mandatory before deploying AI involving systematic profiling, large-scale sensitive data, or automated decisions with significant effects.
Cross-border data transfers: the biggest practical risk
Many AI tools are operated by US companies. Requirements: confirm the provider participates in the EU-US Data Privacy Framework or has Standard Contractual Clauses; conduct a Transfer Impact Assessment; update your privacy notice. The Italian DPA's 2023 ChatGPT suspension and enforcement actions in France and Spain demonstrate this is actively enforced. This is not a theoretical concern — document your transfer safeguards before using overseas AI tools with personal data.
