GDPR and AI: Enterprise compliance requirements

GDPR and AI represent one of the most consequential regulatory intersections in enterprise technology today. Most organisations building AI systems understand that GDPR applies to their products. Fewer have mapped exactly which articles apply, at which stage of the AI lifecycle, and what each obligation requires in practice.

This guide covers the specific GDPR provisions that apply to enterprise AI development and deployment: Articles 5 and 6 at the data collection stage, Article 9 for special category training data, Article 22 for automated decision-making, and the data minimization tension that defines the central compliance challenge. This is not legal advice. Consult your data protection officer and legal team before making compliance decisions for your specific systems.

GDPR Articles 5 and 6: lawful basis for training data collection

The obligation to establish a lawful basis for processing personal data applies before collection begins, not after a model has been trained on the data. Article 6 of GDPR sets out the legal conditions under which personal data may be processed. For AI training data collection, the relevant bases are legitimate interests under Article 6(1)(f), explicit consent under Article 6(1)(a), and for public sector AI, public task under Article 6(1)(e).

Legitimate interests is the basis most enterprise AI teams attempt to rely on for training data. It requires a three-part test: identifying a legitimate interest, demonstrating that the processing is necessary to achieve it, and documenting that the interest is not overridden by the fundamental rights of data subjects. For large-scale collection of voice, text, or behavioral data from consumers, the balancing test is difficult to pass. Data subjects whose data is collected for AI training often have no relationship with the AI developer and receive no direct benefit from the processing.

Consent under Article 6(1)(a) is more defensible for primary collection but introduces operational requirements that many data collection pipelines do not satisfy. Consent must be freely given, specific, informed, and unambiguous. For AI training purposes, consent must name the specific use case: “your voice recording will be used to train automatic speech recognition models” is required; “your data may be used to improve our services” is not sufficient.

Article 5 imposes six data quality principles that apply regardless of which lawful basis is used. Purpose limitation under Article 5(1)(b) means data collected for one purpose cannot be repurposed for AI training without reassessing the lawful basis. Storage limitation under Article 5(1)(e) applies to training datasets as well as operational data: retention schedules must cover training corpora, not just production databases.

GDPR and AI training data: the Article 9 threshold

Article 9 of GDPR governs special categories of personal data and sets a higher protection standard than standard personal data. The categories relevant to AI training data are health data, biometric data, and data revealing racial or ethnic origin.

Voice recordings are biometric data when they are processed to identify or authenticate an individual. This classification applies at the collection stage, not based on the intended use of the trained model. A speech corpus collected to train a transcription model is nonetheless a collection of biometric data if the recordings can be used to identify speakers. The EU’s supervisory authorities, including the European Data Protection Board, have confirmed this interpretation consistently since GDPR took effect.

The Article 9 lawful bases for processing special category data are narrower than Article 6. For AI training purposes, explicit consent under Article 9(2)(a) is the primary defensible basis. This consent must be separate from any general consent to the service, must name the AI training use case explicitly, and must specify the categories of AI system that will be trained. The right to withdraw consent without detriment must be preserved, and withdrawal must be technically possible: individual recordings must be traceable in the training dataset to enable deletion requests.

Health data in AI systems covers more than medical records. Stress detection models, wellness monitoring applications, and symptom assessment AI all process health data. Any AI system that infers health status from behavioral signals is processing health data under Article 9, even if the underlying training data was collected without health-related context.

GDPR and AI: what Article 22 requires for automated decisions

Article 22 governs automated individual decision-making, including profiling. It applies when a decision is made based solely on automated processing and produces legal effects or similarly significant effects on a natural person.

The scope of Article 22 in AI deployments is broader than many compliance teams assume. Credit decisions, insurance premium calculations, recruitment filtering, and content moderation all produce effects that meet the “similarly significant” threshold. A credit application rejected by an AI underwriting model without human review is an Article 22 decision. A job application filtered out by an AI screening tool before any human reviews it is an Article 22 decision.

Article 22(1) establishes a default prohibition on solely automated decisions with significant effects. The exceptions in Article 22(2) require either explicit consent, contractual necessity, or a specific national law authorizing the processing. Where an exception applies, Article 22(3) requires that controllers implement measures to safeguard data subjects’ rights, including the right to obtain human intervention, to express a point of view, and to contest the decision.

Human review under Article 22 must be substantive. A human reviewer who lacks access to the factors driving the AI output, or who approves AI decisions without meaningful examination, does not satisfy the exception requirement. This has direct implications for explainability: if a model’s output cannot be explained to the human reviewer in terms that allow genuine evaluation, the human review requirement cannot be satisfied in practice.

GDPR and the EU AI Act: where the frameworks overlap

The EU AI Act’s high-risk AI system framework under Annex III creates obligations that overlay GDPR’s requirements without replacing them. Organisations building AI systems in categories such as employment screening, credit assessment, education, and essential public services must satisfy both frameworks concurrently.

Under the EU AI Act, Article 10 sets data governance standards for training data used in high-risk AI systems. These standards require documentation of data collection methodology, bias examination results, and demographic coverage. Article 10 also requires that training data be relevant to the deployment context and free of errors, which in practice means human-verified annotations for subjective labeling tasks. For a detailed breakdown of how EU AI Act Article 10 applies to training data sourcing, see our guide to EU AI Act high-risk AI training data requirements.

GDPR and EU AI Act obligations do not cancel each other out. A data processing agreement that satisfies GDPR’s requirements for a lawful basis and data subject rights does not substitute for EU AI Act conformity documentation. An Article 10-compliant training data package does not address GDPR’s storage limitation, purpose limitation, or rights fulfillment obligations. Enterprise AI compliance programs must track both frameworks in parallel.

The EU AI Act’s obligation to register high-risk AI systems in the EU database introduces an additional documentation requirement that intersects with GDPR’s privacy-by-design principle. System registrations that include details about training data sources and processing methods may themselves constitute personal data disclosures if the training data involved personal data processing. This intersection requires coordination between the AI compliance function and the privacy function.

The data minimization tension in enterprise AI

Article 5(1)(c) of GDPR requires that personal data be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” This principle is in structural tension with modern machine learning, which generally performs better with larger and more diverse training datasets.

The tension is real and cannot be resolved by choosing one principle over the other. GDPR’s data minimization requirement applies to AI training data collection. The practical approaches that allow AI development to proceed while satisfying data minimization fall into three categories.

Privacy-by-design architecture addresses minimization at the system design stage. Collecting data points sufficient for the training objective rather than broad behavioral logs, implementing on-device processing where the model operates without transferring raw data to central servers, and aggregating data before it enters the training pipeline are all privacy-by-design approaches that reduce the volume of personal data requiring GDPR compliance controls.

Federated learning allows model training to occur on distributed data without centralizing the underlying personal data. The model learns from data held locally on devices or by partner organizations, and only model updates rather than raw data are aggregated. Federated learning does not eliminate GDPR obligations entirely: the model updates themselves may contain information about the training data, and the coordination infrastructure processes metadata. However, it substantially reduces the personal data exposure of the training process.

Synthetic data generation, with caveats, can supplement or partially replace personal data in training pipelines. Synthetic data generated from a base dataset of personal data is not automatically personal data, but the generation method affects the assessment. If the synthetic data can be reverse-engineered to identify individuals from the base dataset, GDPR obligations attach. Synthetic data that genuinely introduces no identifiable information about the individuals in the source dataset reduces the training pipeline’s personal data footprint. However, synthetic data introduces its own quality risk: models trained on synthetic data may not generalize to real-world speech and behavior patterns adequately for production deployment.

For enterprise AI teams building systems where real human-generated data is required for production accuracy, the minimization principle is best addressed through precise collection scope definition rather than synthetic substitution. Collecting the categories of data actually required for the training objective, with documented justification for each category, satisfies the minimization principle while preserving training data quality. For voice AI specifically, this means specifying the speaker demographics, languages, recording conditions, and speech act types that the deployment environment requires, rather than collecting broadly and filtering later.

Consent management for AI training data pipelines

For AI systems that rely on consent as the Article 6 or Article 9 lawful basis, consent management infrastructure must support the full lifecycle of data subject rights.

The right of access under Article 15 requires that data subjects can request confirmation of whether their data is processed and a copy of the data. For training data pipelines, this requires that individual contributions be traceable within the dataset.

The right to erasure under Article 17 requires that individual contributions can be removed from training datasets. This has practical implications for model versioning: a model trained on a dataset from which data has since been erased may need to be retrained or evaluated for the continued effect of the erased data on model outputs. The concept of machine unlearning addresses this technically, though the field remains developing.

The right to object under Article 21 allows data subjects to object to processing based on legitimate interests. Where legitimate interests is the Article 6 basis for training data collection, the controller must stop processing for each data subject who objects unless compelling legitimate grounds that override the individual’s interests can be demonstrated.

Consent withdrawal must be as easy as granting consent. A data collection platform that allows contributors to submit recordings in a few clicks must allow withdrawal in a comparable number of steps. Withdrawal must be processed without detriment to the data subject.

YPAI’s data collection infrastructure is designed around these requirements. Consent records are captured per contributor per use case, withdrawal requests are processed within 72 hours, and individual recordings are traceable throughout the storage and processing pipeline. Our GDPR-compliant speech data collection guide covers the collection infrastructure requirements in detail.

GDPR and AI model outputs as personal data

A category of GDPR compliance that receives less attention than training data is the status of model outputs as personal data. Where an AI model generates output that relates to an identifiable individual, that output is personal data subject to GDPR.

This applies most clearly to AI systems that generate profiles, predictions, or assessments about named or identifiable individuals. A credit scoring model’s output about an identifiable applicant is personal data. An AI-generated assessment of a job candidate’s suitability is personal data. A behavioral analysis identifying patterns associated with a specific user account is personal data if the account is linked to an identifiable individual.

The controller obligations for AI-generated personal data include the same Article 5 quality principles that apply to input data: accuracy, storage limitation, and purpose limitation. An AI system that generates inaccurate personal data about individuals and retains that data indefinitely violates GDPR even if the input data was lawfully collected.

For enterprise AI deployments that generate assessments, predictions, or recommendations about individuals, output data governance must be incorporated into the compliance program alongside input data governance. This includes retention schedules for AI-generated outputs, accuracy verification mechanisms, and procedures for correcting inaccurate AI outputs in response to data subject requests under Article 16.

Building GDPR-compliant AI on sovereign European data infrastructure

The compliance obligations described above apply from the first data collection decision through every model update and deployment. Retrofitting GDPR compliance into an AI system built on data collected without these controls in place is substantially more expensive than building compliance in from the start.

For AI systems that require speech, behavioral, or other human-generated training data, the practical compliance path begins with the data infrastructure. Training data that was collected under documented Article 6 or Article 9 lawful bases, with individual consent records that name the AI training use case, with erasure capability down to the individual contributor level, and with EEA-only residency throughout the pipeline, satisfies the foundational GDPR obligations before model training begins.

YPAI provides EEA-native speech corpora with GDPR-native consent documentation, right-to-erasure-ready records, and EU AI Act Article 10 data governance packages. Collection is Datatilsynet supervised, residency is EEA-only, and consent records are maintained per contributor per use case. For organisations assessing their AI training data compliance posture, our EU speech data sovereignty guide covers the data infrastructure requirements that GDPR compliance for enterprise AI requires.

If you are building or procuring AI systems that process personal data and want to discuss training data requirements, contact our data team to review your compliance requirements.

Sources:

• GDPR Articles 5 and 6 - Lawful processing principles (EUR-Lex)
• GDPR Article 9 - Special categories of personal data (GDPR-info.eu)
• GDPR Article 22 - Automated individual decision-making (GDPR-info.eu)
• EU AI Act Official Text - Article 10 Data and data governance (EUR-Lex)
• EDPB Guidelines on Automated Decision-Making and Profiling
• European Commission: Data protection in AI (Digital Strategy)