Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
This opinion by the European Data Protection Board addresses key data protection aspects related to the processing of personal data in the development and deployment of AI models. It clarifies when an AI model can be considered anonymous, how controllers can demonstrate legitimate interest as a legal basis during development and deployment, and the consequences of unlawful initial processing on subsequent operations. The document provides a framework for national supervisory authorities to assess these issues on a case-by-case basis.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
National supervisory authorities, data controllers, and AI developers seeking guidance on GDPR compliance when developing and deploying AI models.
What the document contains
The opinion covers the application of GDPR principles to AI models, specifically addressing the criteria for model anonymization, the use of legitimate interest as a legal basis in development and deployment phases, and the legal consequences of unlawful data processing during model training.
It does not provide an exhaustive analysis of special categories of data under Article 9 GDPR or detailed technical mandates outside of general risk assessment frameworks.
- AI models trained on personal data cannot in all cases be considered anonymous and must be assessed on a case-by-case basis.
- Controllers relying on legitimate interest during AI model development and deployment must complete a rigorous three-step test.
- The lawful basis assessment must balance the controller's interests against the fundamental rights and freedoms of data subjects, taking into account reasonable expectations.
- Mitigating measures and technical safeguards can limit the impact of processing on data subjects but do not replace mandatory GDPR compliance.
- Unlawful processing during the development phase may impact the lawfulness of subsequent processing depending on specific factual scenarios.
1 Introduction 2 Scope and key notions 3 On the merits of the request 4 Final remarks
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Human Dignity
2/5Respect for the inherent worth of persons
By protecting the fundamental right to data protection, GDPR supports these opportunities and promotes other EU fundamental rights, including the right to freedom of thought, expression and information
Adopted 2
screening score · 2026-10-23
Human Oversight
1/5Humans remain in control of consequential decisions
AI technologies create many opportunities and benefits across a wide range of sectors and social activities.
Adopted 2
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
By protecting the fundamental right to data protection, GDPR supports these opportunities and promotes other EU fundamental rights
Adopted 2
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
Transparency about the processing of personal data includes, in particular, compliance with the information obligations as set out in Articles 12 to 14 GDPR
Section 3.3.1
screening score · 2026-10-23
Enforcement
4/5Consequences and compliance mechanisms with real force
SAs enjoy discretionary powers to assess the possible infringement(s) and choose appropriate, necessary, and proportionate measures, taking into account the circumstances of each individual case.
Adopted 4
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
DPIAs are an important element of accountability, where the processing in the context of AI models is likely to result in a high risk to the rights and freedoms of natural persons
Section 2.1
screening score · 2026-10-23