GDPR

GDPR for AI: lawful basis, DPIAs, Article 22 and international transfers

The GDPR applies whenever an AI system processes personal data, in prompts, retrieved context, outputs or training. It is in force and unchanged: the GDPR half of the Digital Omnibus is still a proposal. For LLM deployments the practical questions are lawful basis, processor terms, DPIA, solely automated decisions under Article 22, security, and where data goes.

Last verified 2026-10-06sources

Build with AI Talk to our team

Who this applies to

Controllers deploying AI: Organisations that decide the purposes and means of processing personal data with an AI system. Most customers of an AI platform are controllers.
Processors: Platforms and model hosts acting on a controller's documented instructions. Article 28 requires a written contract.
Model developers: Whoever trains or fine-tunes a model on personal data must have a lawful basis for that processing, as the EDPB examined in Opinion 28/2024.

Status check: what changed and what did not

The GDPR (Regulation (EU) 2016/679) is unchanged. Fines are up to EUR 10 million or 2% of worldwide turnover (Article 83(4)) and up to EUR 20 million or 4% (Article 83(5)), whichever is higher.

The Commission's November 2025 Digital Omnibus has two parts. The AI part became law as Regulation (EU) 2026/1744. The GDPR and ePrivacy part is a separate proposal that is not law. As of early October 2026 secondary sources report no Council mandate and a committee vote expected in early 2027, with proposals on the definition of personal data and on legitimate interest for AI training contested, and the Council reportedly dropping an Article 22 rewrite (Acompli, PrivacyNext, EDPB-EDPS Joint Opinion 2/2026). Plan on current GDPR text.

Lawful basis and the EDPB position on AI models

The EDPB's Opinion 28/2024 is the main EU-level guidance on personal data in AI models.

Models are not automatically anonymous. Whether a model trained on personal data is anonymous is a case-by-case question for the authority.
Legitimate interest can work, with a three-step test. Identify a legitimate interest that is lawful, clearly articulated, real and present; show necessity; and balance it against data subjects' rights. Examples the EDPB treats as potentially legitimate include conversational agents that assist users, fraud detection and AI-based cybersecurity.
Development can taint deployment. Unlawful processing during development may affect later use. A deploying controller that is not the developer should assess, as part of accountability, whether the model was developed lawfully. A properly anonymised model is treated differently.

For an organisation using a third-party model through an API, the question is usually its own prompts and context: what personal data goes in, for what purpose, on which basis, and with whom it is shared. Data minimisation, filtering and masking before the model call reduce both risk and the DPIA surface. The EDPB support-pool report on AI privacy risks and mitigations in LLMs (April 2025) catalogues risks and mitigations along the LLM lifecycle.

Article 22: solely automated decisions

Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. The exceptions are contract necessity, authorisation by law and explicit consent, each with safeguards that include human intervention.

C-634/21 SCHUFA (7 December 2023). The Court of Justice held that a credit score can itself be an Article 22 decision where a lender draws strongly on it.
C-203/22 Dun & Bradstreet Austria (27 February 2025). The data subject is entitled to a meaningful explanation of the procedure and principles actually applied, without wholesale disclosure of the algorithm, and trade-secret claims are balanced (Bird & Bird analysis, secondary source).

Practical consequence: an "AI recommends, human approves" design only helps if the human review is real. Record who reviewed, what they saw and whether they could and did depart from the recommendation.

Processors, security and DPIA

Article 28. A written contract covering documented instructions, confidentiality, sub-processor authorisation, assistance, deletion or return, and audits.
Article 32. Security appropriate to risk: pseudonymisation and encryption, confidentiality, integrity, availability and resilience, and regular testing.
Article 25. Data protection by design and by default.
Article 35. A DPIA where processing is likely to result in high risk, in particular systematic and extensive profiling with significant effects, large-scale special-category data, or large-scale systematic monitoring. See DPIA for AI.

International transfers and the EU data boundary

Chapter V (Articles 44 to 49) allows transfers through an adequacy decision (Art. 45), safeguards such as standard contractual clauses or binding corporate rules (Art. 46), or narrow derogations (Art. 49). Schrems II (C-311/18, 16 July 2020) invalidated Privacy Shield and requires a transfer impact assessment for SCCs.

The EU-US Data Privacy Framework adequacy decision dates from 10 July 2023. The General Court dismissed the Latombe challenge on 3 September 2025, and an appeal is pending at the Court of Justice as case C-703/25 P (Digital Policy Alert, secondary source). Check the current status before you rely on it.

How the platform supports it

Each row maps a requirement to a platform control, the evidence artifact it produces, and the Trust & Governance Fabric facets involved. Swfte provides the controls and the evidence. You remain responsible for the decisions.

Requirement	Platform control	Evidence artifact	Fabric facets
Data minimisation and purpose limitation for prompts and context	Classification, masking and boundaries on what an agent can read; filter and mask verbs.	Data-access records and policy decisions per request.	Data controls, Privacy, Policy
Art. 28: processor terms and sub-processor transparency	A published sub-processor list and a Data Processing Agreement.	Sub-processor list and DPA. The DPA on the site is a draft template pending legal review.	Compliance, Evidence
Art. 32: security of processing	TLS in transit, encryption at rest, scoped access, an identity for every user and agent.	Security overview and architecture description on request.	Security, Identity, Access
Art. 22: meaningful human intervention	Human-approval rules for decisions with significant effects, with the reviewer recorded.	Approval records showing reviewer, inputs and outcome.	Human oversight, Auditability
Art. 30 and accountability: show what was processed	Per-action trace from data to model to agent to decision to outcome.	Exportable audit trail to support records of processing.	Traceability, Auditability, Evidence
Chapter V: know where data goes	The Trust Profile records data residency; EU region hosting is designed for, scoped through a dedicated deployment.	Trust Profile data-residency field and deployment description.	Data controls, Compliance

Compliance-by-design. Swfte provides the technical controls, governance mechanisms and evidence to support deployment within applicable requirements. The exact posture depends on your use case, jurisdiction, deployment and configuration. This is not legal advice.

Hosting today: customer data is stored in AWS eu-west-1 (Ireland), as stated on the trust page. EU region, in-country, dedicated and on-prem options are the platform position: what it is designed to let you do, scoped with you through a dedicated deployment engagement, not self-serve.

What this does not cover

Swfte does not choose your lawful basis or decide whether your processing is lawful. The controller does.
It does not make a model anonymous, and does not determine whether a third-party model was developed lawfully.
It does not write or sign your DPIA, your legitimate-interest assessment or your transfer impact assessment.
It does not replace a data protection officer, and platform controls do not satisfy data-subject rights requests on their own.
Customer data is stored in AWS eu-west-1 (Ireland) today, as stated on the trust page; other locations are scoped per dedicated deployment, not self-serve.

Frequently asked questions

Does the GDPR apply to LLM prompts?

Yes, if prompts, retrieved context or outputs contain personal data. That covers names, email addresses and any data that identifies a person indirectly. The controller needs a lawful basis, a purpose, a processor contract and security measures.

Can we use legitimate interest for AI?

Possibly. The EDPB says authorities should apply a three-step test: a lawful, clearly articulated, real and present interest; necessity; and balancing against data subjects' rights. It is case by case, so document it.

Is a model trained on personal data anonymous?

Not automatically. The EDPB says it is a case-by-case question for the authority, and unlawful development processing can affect later use unless the model is properly anonymised.

Is the EU-US Data Privacy Framework still valid?

The adequacy decision dates from 10 July 2023, the General Court dismissed the Latombe challenge on 3 September 2025, and an appeal (C-703/25 P) is reported as pending. Check the current status before relying on it.

Did the Digital Omnibus change the GDPR?

Not yet. The GDPR and ePrivacy amendments are a separate proposal and were not adopted as of October 2026, per secondary sources.

Does using Swfte meet my GDPR obligations?

We do not use a compliance label. Whether obligations are met depends on how a controller uses a system. Swfte is built compliance-by-design: it provides the technical controls, governance mechanisms and evidence to support deployment within applicable requirements, and the posture depends on your use case, jurisdiction, deployment and configuration. This is not legal advice.

Sources

Last verified 2026-10-06. Primary sources are EUR-Lex and European Commission pages. Items marked as secondary are commentary or trackers; check the primary text before relying on them.

Across the platform

The controls on this page are part of the Trust & Governance Fabric that runs through every layer of the Sovereign Intelligence Platform.

AI governance
Governance that runs inside AI, not beside it.
AI sovereignty
Seven kinds of control over your AI estate.
Trust Profile
The record of what each AI system is and may do.
Trust centre
What Swfte can show today, and what it does not claim.

Build EU-first AI with the evidence already running

Start with one entry point. Add governance, in-region options and evidence as your requirements grow.