Summary
- Automated decisions (Art. 22): people have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects. Allowed only for a contract, under EU or member state law, or with explicit consent, and then with safeguards: human intervention, the chance to express a view, and to contest.
- Meaningful information about the logic (Arts. 13(2)(f), 14(2)(g), 15(1)(h)): for such decisions you must tell people the logic involved and the likely consequences. The CJEU in C-203/22 (2025) held this means explaining the procedure and principles actually applied, in an understandable way.
- DPIA (Art. 35): required for high-risk processing, expressly including systematic, extensive evaluation through automated processing that produces significant effects (Art. 35(3)(a)). Most AI on personal data will need one.
- Lawful basis for training (Art. 6, Art. 9): each phase of an AI lifecycle needs a lawful basis. EDPB Opinion 28/2024 says legitimate interest can work, subject to the three-step test, and that whether a model is anonymous must be judged case by case. Special category data needs an Art. 9 exception.
- Reach (Art. 3(2)): applies to non-EU companies that offer goods or services to people in the EU or monitor their behaviour there.
Who it applies to
- Controllers and processors in the EU, plus non-EU controllers and processors under Art. 3(2). Non-EU controllers usually must appoint an EU representative (Art. 27).
- All sectors, public and private.
Key dates
- GDPR adopted
- GDPR applies
- CJEU SCHUFA ruling (C-634/21): a credit score can itself be an Art. 22 decision
- EDPB publishes Opinion 28/2024 on AI models
- CJEU Dun & Bradstreet Austria ruling (C-203/22) on explaining automated decisions
- Commission proposes Digital Omnibus amending the GDPR (COM(2025) 837, 2025/0360(COD))
Full date record
| Date | Event |
|---|---|
| 2016-04-27 | Adopted |
| 2018-05-25 | Applies |
| 2023-12-07 | CJEU C-634/21 SCHUFA (credit scoring and Art. 22) |
| 2024-12-18 | EDPB Opinion 28/2024 on AI models published (adopted 2024-12-17 per secondary sources) |
| 2025-02-27 | CJEU C-203/22 Dun & Bradstreet Austria (right to explanation) |
| 2025-11-19 | Digital Omnibus proposal amending the GDPR |
| 2026-09-20 | EP Legislative Train: Omnibus still "tabled"; no Parliament or Council position; COREPER vote of 2026-06-26 cancelled |
Penalties and enforcement
- Art. 83(5): up to EUR 20 million or 4% of global turnover for lawful basis, principles and data subject rights failures (Art. 22 included).
- Art. 83(4): up to EUR 10 million or 2% for controller duties such as DPIAs.
- Enforced by each national authority; cross-border cases run through the one-stop-shop and the EDPB. Authorities can also order processing to stop (Art. 58(2)(f)), which matters more than fines for a model trained unlawfully.
What it means for an Indian company
- If your AI product serves users in the EU, or monitors their behaviour (for example tracking or profiling on an app), the GDPR applies directly even with no EU office (Art. 3(2)).
- Indian processors for EU clients (BPOs, IT services, SaaS) are bound through Art. 28 contracts and transfer clauses. Clients will ask for help with DPIAs and logic explanations.
- Practical steps: document a lawful basis for each training and inference purpose (SC-AI-011 Lawful basis and consent for personal data used in AI); run DPIAs for AI uses (SC-AI-006 AI impact assessment (people and society)); build contest and human review routes for automated decisions (SC-AI-027 Right to contest and human review for individuals); prepare plain-language explanations of the logic (SC-AI-024 Explain AI-assisted decisions); minimise and set retention for training data (SC-AI-012 Data minimisation and retention for AI).
- If a model may memorise personal data, keep evidence of tests showing it is hard to extract, since anonymity is judged case by case under Opinion 28/2024.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when EU GDPR is done.
Glossary
- Controller: decides why and how personal data is processed.
- Processor: processes personal data on the controller's behalf.
- Profiling: automated evaluation of personal aspects such as performance, finances, health or behaviour.
- DPIA: Data Protection Impact Assessment, a documented risk check before high-risk processing.
- Legitimate interest: a lawful basis requiring a purpose test, a necessity test and a balancing test.
- EDPB: European Data Protection Board, which issues guidance and binding decisions.
- CJEU: Court of Justice of the European Union.
Key takeaways
- Not AI-specific, but Art. 22, the logic-explanation duties, DPIAs and lawful basis rules bite hard on AI.
- Extraterritorial: Indian companies serving or monitoring EU users are directly covered.
- EDPB Opinion 28/2024 is the key regulator view on training and model anonymity.
- The Digital Omnibus GDPR changes are proposals only as of 2026-10-19.
Official sources
- Regulation (EU) 2016/679, EUR-Lex, accessed 2026-10-19
- EDPB Opinion 28/2024 on AI models, accessed 2026-10-19
- European Parliament Legislative Train: Digital Omnibus Regulation, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.