AI and GDPR: where the two regimes overlap for European companies
The EU AI Act is the new rule everyone is preparing for. GDPR is the one that has been quietly applying to your AI all along.
AI and GDPR meet the moment an AI tool touches personal data, which is almost always. Most teams treat the EU AI Act as the headline regulation and forget that the General Data Protection Regulation already governs how that same AI handles names, emails, customer records and employee data. The two regimes overlap, and an AI programme that satisfies one can still fail the other.
This guide covers where AI and GDPR intersect, the obligations that catch teams out, and how to keep one set of evidence that serves both. For the wider regulatory picture, see the EU AI Act explained.
Why GDPR applies to almost every AI tool
GDPR governs the processing of personal data of people in the EU. An AI tool that summarises support tickets, screens CVs, drafts customer emails or analyses user behaviour is processing personal data, so GDPR applies regardless of whether the tool is classed as high-risk under the AI Act. The trigger is the data, not the label, and that is why GDPR reaches further into your stack than many teams assume.
Where AI and GDPR overlap
Lawful basis. You need a legal ground to process personal data through an AI system, and consent buried in a vendor's terms rarely covers feeding customer data into a model.
Purpose limitation. Data collected for one purpose cannot be repurposed to train or fine-tune a model without fresh justification, a line shadow AI crosses constantly.
Data minimisation. Pasting an entire document into a public chatbot to extract one figure is hard to defend when the principle is to process the least data necessary.
Transfers and subprocessors. Many AI tools route data through providers outside the EU, so the hosting and subprocessor chain becomes a GDPR question as much as a security one.
Grasp maps that subprocessor and hosting chain for each AI vendor through automated vendor assessments, so the transfer question is answered before an auditor asks it.
Automated decisions. Article 22 gives people rights around solely automated decisions with significant effects, which overlaps directly with the AI Act's high-risk category covered in the risk classification guide.
How the two regimes fit together
The AI Act and GDPR are designed to stack, not to replace each other. The AI Act adds obligations about the AI system itself, such as risk classification, transparency and human oversight, while GDPR governs the personal data flowing through it. A high-risk hiring tool owes AI Act conformity duties and GDPR duties at the same time, which is why building separate compliance programmes wastes effort. The same inventory, the same data-flow records and the same oversight evidence feed both.
The practical starting point
Both regimes assume you know which AI systems are in use and what data each one touches, and that single fact is what most organisations cannot produce. Start by discovering every AI tool in use, including the embedded and unsanctioned ones, then record the personal data each processes and where it goes. The AI inventory guide shows how to build a list that holds up under both an AI Act audit and a GDPR review.
Frequently asked questions
Does GDPR apply to AI tools?
Yes, whenever an AI tool processes personal data of people in the EU, which covers most workplace AI. GDPR applies to the data regardless of how the AI system is classified under the EU AI Act, so the two sets of obligations run in parallel.
What is the difference between the EU AI Act and GDPR?
The EU AI Act regulates AI systems by their risk and use, adding duties such as classification, transparency and oversight. GDPR regulates personal data and how it is processed. An AI tool handling personal data is typically subject to both at once.
Can an AI tool be GDPR compliant but breach the AI Act?
Yes. Handling personal data lawfully does not satisfy the AI Act's separate obligations around high-risk classification, conformity and transparency. The reverse is also true, which is why both regimes need to be assessed together rather than treated as one.
Does using AI to train on customer data breach GDPR?
It can. Repurposing data collected for one reason to train or improve a model engages purpose limitation and usually needs a fresh lawful basis. Many AI vendors train on inputs by default, so checking and disabling that is a common first fix.
Where do AI and GDPR overlap most?
On lawful basis, purpose limitation, data minimisation, international transfers through subprocessors, and automated decision-making. Each is a GDPR principle that an ungoverned AI tool tends to strain at the same time as it raises AI Act questions.
Grasp discovers every AI tool in use, maps the personal data each one touches and classifies it against both the EU AI Act and GDPR, so you maintain one evidence base instead of two. See the compliance readiness solution →
