GDPR and AI: personal data in algorithms and automated decisions

The GDPR applies in full as soon as an AI system processes data about an identifiable person, in training, in use or in its logs. You then need a legal basis for each step, you must explain the logic of the system to the people concerned, and a decision taken solely by the machine with significant effects is only allowed under the strict conditions of Article 22 GDPR.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) enforces these rules. The EU AI Act adds a separate product-safety layer on top, but it does not replace or relax any GDPR obligation. For the question of how to assemble a training dataset lawfully, see our article on GDPR and big data.

When does the GDPR apply to an AI system?

The GDPR applies whenever personal data is processed, whatever the technology (Article 2 GDPR). In an AI application that happens at three moments: training, use (inference) and logging.

A trained model is not automatically anonymous. In Opinion 28/2024 of 17 December 2024, the European Data Protection Board (EDPB) concluded that a model may retain personal data that can be extracted, which must be assessed per model. If the model was trained on unlawfully processed data, that can also affect the lawfulness of using it. The basics are in our introduction to data protection law.

Who is responsible in an AI chain?

Responsibility follows decision-making, not technology. The party that decides the purposes and means is the controller; the party that only follows instructions is the processor (Article 4 GDPR).

A model vendor is usually a controller for its own development and a processor for the customer’s use. If the contract allows the vendor to use your input to improve its own model, it becomes a controller for that purpose. See our articles on the roles of controller and processor and the data processing agreement. If data goes to providers outside the EEA, Chapter V GDPR also requires a transfer tool.

When is an automated decision allowed?

Under Article 22 GDPR, a decision based solely on automated processing that has legal or similarly significant effects is in principle prohibited. It is only allowed if it is necessary for a contract, authorised by law with safeguards, or based on explicit consent.

Three questions decide whether Article 22 applies:

• Is the decision based solely on automated processing? A token human sign-off does not change that; the reviewer must have real authority and actually weigh the outcome.
• Are the effects legal or similarly significant? Examples are refusal of credit, rejection of a job application or blocking a customer after a fraud flag.
• Is it about an individual? General pricing rules fall outside; individual scoring falls inside.

In SCHUFA (CJEU 7 December 2023, C-634/21), the Court of Justice held that producing a credit score is itself an automated decision if a third party relies heavily on it to decide on a contract. Organisations that buy in credit, fraud or risk scores must therefore check what their supplier does.

Where an exception applies, the person has at least the right to human intervention, to express their view and to contest the decision (Article 22(3) GDPR). That requires a staffed and documented procedure, with reviewers who see the underlying data and record why they confirm or depart from the outcome.

What must you explain about an algorithm?

For automated decisions, Articles 13, 14 and 15 GDPR require you to tell people that the decision is automated, give meaningful information about the logic involved, and explain the consequences. This applies when you collect the data and again on request.

In Dun & Bradstreet Austria (CJEU 27 February 2025, C-203/22), the Court held that the explanation must describe the procedure and principles actually applied, so that the person can check their data and challenge the decision. If you consider that the explanation would reveal trade secrets, you may not simply refuse: you must give the information to the supervisory authority or the court, which decides what must be disclosed. See also our article on the right of access under Article 15 and our guide to a privacy policy in the Netherlands.

Which legal basis do you need for training and use?

Each processing step needs its own legal basis under Article 6 GDPR, and the basis for training is not automatically the basis for use. In practice the options are consent, necessity for a contract and legitimate interest.

A purely commercial interest can be a legitimate interest, as the Court of Justice confirmed in the Dutch KNLTB case (CJEU 4 October 2024, C-621/22), but only if the processing is truly necessary and the balance of interests holds. Write that assessment down before you start.

Special categories of data, such as health data, biometric data for identification and data revealing ethnic origin, may only be processed under an exception in Article 9 GDPR. This also applies if the model infers such a characteristic from ordinary data. See our article on biometric data and GDPR compliance.

Output about an identifiable person, such as a risk score or a generated statement, is personal data. It must be accurate, and the person has the rights of access and rectification (Articles 15 and 16 GDPR).

How does the law deal with bias and discrimination?

An algorithm that systematically produces worse outcomes for a protected group makes an indirect distinction under the Dutch General Equal Treatment Act (Algemene wet gelijke behandeling, AWGB). That is unlawful unless it is objectively justified by a legitimate aim and appropriate and necessary means.

The Netherlands Institute for Human Rights (College voor de Rechten van de Mens) handles complaints about this. In the SyRI case, the District Court of The Hague held the legislation behind a fraud risk system contrary to Article 8 of the European Convention on Human Rights, because the system was not transparent or verifiable (ECLI:NL:RBDHA:2020:865, 5 February 2020).

Who supervises AI and algorithms in the Netherlands?

The AP supervises the GDPR together with the Dutch GDPR Implementation Act (UAVG) and has a separate department for coordinating algorithm supervision; see our article on the Dutch Data Protection Authority. GDPR fines can reach €20 million or 4% of worldwide annual turnover (Article 83 GDPR).

Sector supervisors keep their own powers, such as the financial supervisors for models in banking and insurance. Government bodies must also meet the Awb requirements that a decision is prepared with due care and properly reasoned; “the system produced this outcome” is not a reason.

How does the AI Act relate to the GDPR?

The AI Act regulates AI systems as products, by risk class. It does not provide a legal basis for processing personal data; where an AI system processes personal data, both regimes apply side by side.

The prohibitions on unacceptable practices and the rules for general-purpose AI models already apply. Under the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), the obligations for high-risk systems in Annex III, such as recruitment, credit scoring and education, apply from 2 December 2027, and those for AI in products regulated under Annex I from 2 August 2028. See our guides to the EU AI Act and high-risk AI systems.

A data protection impact assessment (DPIA) under Article 35 GDPR is in practice required for most AI systems that evaluate people. Combine it with the AI Act risk management and, where required, the fundamental rights impact assessment, so that one file answers all supervisors.

What should you check as an organisation using AI?

Accountability means you must be able to prove compliance (Article 5(2) GDPR). Check these points before the system goes live.

• Does your record of processing describe training data, inputs, outputs and logs for each model?
• Is there a written legal basis, and a legitimate-interest assessment where you rely on it, for each step?
• Does the system take decisions within Article 22 GDPR, directly or through a supplier’s score?
• Can you explain the logic in terms a customer or employee understands?
• Have you tested the outcomes for indirect discrimination and recorded the results?
• Have you carried out a DPIA and checked the AI Act risk class?

What should you check as a person affected by an algorithm?

You can use your GDPR rights against any organisation that uses your data in an AI system. Check these points if a decision about you seems automated.

• Was the decision taken without real human involvement?
• Did the organisation tell you that automated decision-making is used?
• Ask for access under Article 15 GDPR, including meaningful information about the logic.
• Ask for human intervention and contest the decision under Article 22(3) GDPR.
• If the organisation does not respond within one month, consider a complaint to the AP.

What can we do for you with GDPR and AI?

Our privacy lawyers advise companies that develop or use AI, and individuals affected by automated decisions.

• We assess whether your system falls under Article 22 GDPR and the AI Act high-risk regime.
• We draft the DPIA and the legitimate-interest assessment.
• We review the AI vendor contract for controller roles, model training clauses and transfers.
• We draft the explanation of the logic for your privacy statement and access requests.
• We assist you in an investigation by the Autoriteit Persoonsgegevens.

Summary

• The GDPR applies in full to AI systems that process personal data, in training, use and logging.
• Decisions based solely on automated processing with significant effects are only allowed under Article 22 GDPR, with human intervention on request.
• You must give meaningful information about the logic; trade secrets do not justify a flat refusal (CJEU C-203/22).
• The AI Act applies on top of the GDPR; high-risk obligations under Annex III apply from 2 December 2027.

Frequently asked questions