AI Privacy Laws: What Businesses Need to Know About AI and Data Privacy

When a business uses AI with customer records, employee information, support conversations, uploaded documents, behavioural data or other information about identifiable people, privacy law can become part of the compliance analysis.

There is no single universal "AI privacy law." Existing privacy and data-protection laws can apply to AI processing, while AI-specific legislation may impose separate obligations on the same system. Which requirements apply depends on factors such as jurisdiction, the people whose data is involved, the type of data, the purpose of processing, the AI use case, the organisation's sector and its role in the AI supply chain.

For businesses, the practical question is therefore not simply, "Are we using AI?" It is: What personal data is being processed, why is it being processed, who receives it, what does the AI system do with it, and which laws apply?

This guide explains the major AI privacy issues businesses should understand, including GDPR, U.S. privacy laws, AI training data, vendor risk, automated decision-making and the relationship between privacy law and AI-specific regulation.

AI Privacy Law Snapshot: September 2026

These dates and distinctions matter because older AI compliance articles may reflect rules or implementation schedules that have since changed. The current EU timetable is set out in Regulation (EU) 2026/1744 on EUR-Lex, while California's current status is explained by the California Privacy Protection Agency's finalized regulations.

Do Privacy Laws Apply to AI?

Privacy laws can apply when an AI activity involves processing that falls within the scope of the relevant law. AI does not automatically sit outside existing data-protection rules simply because the technology is new.

Under the GDPR, for example, personal data includes information relating to an identified or identifiable living individual. The European Commission's guidance on the application of the GDPR also explains that pseudonymised or de-identified information can remain personal data if a person can still be re-identified. Information that has been rendered genuinely anonymous so that the person is no longer identifiable is treated differently.

That distinction is particularly important in AI projects because personal data can appear at several points in the system lifecycle.

AI can also create additional privacy questions involving profiling, inference, automated decision-making and reuse of data originally collected for another purpose.

Not every AI system processes personal data. A system working entirely with genuinely anonymous or non-personal information may raise different issues. The analysis should therefore start with the actual data and processing activity, not the "AI" label.

Which Privacy Laws Can Apply to AI?

GDPR and AI in the European Union

Where the GDPR applies, AI-related processing remains subject to its core data-protection principles.

The European Commission's GDPR principles guidance explains that covered personal data must be processed lawfully, fairly and transparently, for specified purposes, and limited to what is necessary. Accuracy, storage limitation, security and accountability can also be relevant throughout the AI lifecycle.

A controller also needs an appropriate lawful basis for covered processing. Depending on the circumstances, GDPR lawful bases can include consent, contract, legal obligation, vital interests, public task and legitimate interests. This means AI does not automatically require consent in every situation.

Special-category data requires additional analysis. The European Commission identifies categories receiving additional protection under the GDPR, including health data, certain biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and information concerning sex life or sexual orientation. The Commission's GDPR rights and sensitive-data guidance explains these categories.

Data-subject rights can also affect AI systems. Depending on the circumstances, relevant GDPR rights include access, rectification, erasure, restriction, objection and rights relating to certain automated decision-making and profiling.

A Data Protection Impact Assessment, or DPIA, is not automatically required simply because an organisation uses AI. The trigger is whether the processing is likely to result in a high risk to individuals' rights and freedoms. The European Commission's guidance on controller obligations and DPIAs provides further detail on when an assessment may be required.

AI model development raises additional questions. EDPB Opinion 28/2024 on AI models addresses three particularly important issues: when a model may be considered anonymous, when legitimate interests may potentially support model development or deployment, and what follows when a model was developed using unlawfully processed personal data. The EDPB emphasises case-by-case analysis rather than a universal answer for every AI model.

U.S. Privacy Laws and AI

The United States does not have one comprehensive privacy framework that applies uniformly to every AI use by every business. Organisations may instead encounter state privacy laws, federal sector-specific laws, consumer-protection rules and other requirements depending on the data and activity.

California is an important example. The CCPA, as amended, gives covered California consumers rights relating to access, deletion, correction, sale or sharing of personal information, and certain uses of sensitive personal information. The California Attorney General's current CCPA guidance also explains that the law applies only to businesses meeting specified statutory conditions.

California's regulatory position has become particularly relevant to AI. The CPPA finalized regulations covering risk assessments, cybersecurity audits and automated decisionmaking technology, or ADMT. The regulations became effective January 1, 2026. Businesses subject to the relevant ADMT requirements for significant decisions must comply with those provisions by January 1, 2027. The CPPA's ADMT guidance and FAQ describe the current requirements and timing.

The finalized rules include, for covered ADMT uses, requirements involving pre-use notice, access and opt-out rights, subject to the regulation's scope and exceptions.

Federal requirements may also become relevant depending on the sector or activity. The Federal Trade Commission has specifically warned AI companies that failing to honour privacy and confidentiality commitments concerning customer information can create enforcement risk. The FTC's guidance for AI companies discusses customer-data and model-training commitments directly.

Businesses assessing U.S. AI regulatory requirements should therefore map the rules relevant to the particular organisation, state, sector, data and AI use case rather than assuming one nationwide AI privacy rule controls every situation.

Other Privacy Regimes Businesses May Encounter

Businesses operating internationally can encounter additional privacy regimes.

In the United Kingdom, data-protection law applies to covered processing involving AI. The UK Information Commissioner's Office maintains AI and data-protection guidance and risk-management resources. Importantly, the ICO states that parts of its detailed AI guidance are under review following changes introduced by the Data (Use and Access) Act, so businesses should check the current version rather than relying on older summaries.

Brazil's LGPD provides the country's principal personal-data framework, and Brazil's data-protection authority, the ANPD, continues active work on AI and personal-data issues. In 2026, the ANPD published further work on generative AI and continued its regulatory sandbox focused on AI and data protection. The ANPD's 2026 generative-AI privacy work provides a current example.

China's Personal Information Protection Law, or PIPL, covers personal-information processing and includes provisions concerning sensitive information, automated decision-making and cross-border processing. Its territorial scope can also reach certain processing outside China involving people located within China. An official English publication of the PIPL sets out that territorial scope and the definition of personal information.

Japan's primary private-sector privacy framework is the Act on the Protection of Personal Information. The Personal Information Protection Commission publishes the current law, implementing materials and official guidance.

Singapore's Personal Data Protection Commission has issued specific advisory guidelines on personal data used in AI recommendation and decision systems, covering areas such as model development, consent information and the roles of third-party developers.

These examples illustrate why global AI regulation and AI privacy compliance should be assessed jurisdiction by jurisdiction rather than reduced to a single worldwide rulebook.

How AI Changes Common Privacy Compliance Requirements

Lawful Basis and Consent

The correct starting point is the processing activity.

Training a model, uploading customer records into a generative AI service, analysing employee behaviour and generating a customer-risk profile can all involve different purposes, parties and legal requirements.

Under GDPR, covered processing requires an applicable lawful basis, but consent is only one possible basis. Organisations should therefore avoid two opposite assumptions: that AI always requires consent, or that existing permission to use data automatically covers every new AI purpose.

Reuse deserves particular attention. When data collected for one reason is later used to train, fine-tune or operate an AI system, organisations should consider whether the new processing remains compatible with the original purpose and whether other legal requirements are triggered.

Data Minimization and Purpose Limitation

AI projects can encourage organisations to collect or expose more information than the task actually requires.

The GDPR's data-minimisation principle requires covered personal data to be adequate, relevant and limited to what is necessary for the processing purpose.

In practice, that can mean removing unnecessary identifiers from prompts, limiting fields included in training datasets, controlling what enterprise documents an AI assistant can retrieve, restricting access to sensitive sources and setting retention limits for prompts, files and logs.

Minimisation should be considered across the entire lifecycle rather than only when a dataset is first collected.

Transparency and Privacy Notices

Privacy notices should reflect what the system actually does.

Depending on the applicable law and processing activity, an organisation may need to explain matters such as purposes, categories of data, legal basis, recipients, retention, transfers and relevant automated processing. The European Commission's GDPR transparency guidance lists core information that organisations may need to provide to individuals.

This should not be confused with AI-specific transparency. Telling a user that they are interacting with an AI chatbot is different from explaining how their personal data will be processed.

Data Subject Rights

AI can make familiar privacy rights operationally difficult.

A person's data may exist in a source database, prompt history, provider log, vector database, fine-tuning dataset or model-related output. A rights-handling process therefore needs to identify where information is held before determining what action is legally and technically required.

The applicable result can differ by jurisdiction and system architecture. An organisation should not assume that a deletion request, for example, necessarily requires the same technical action across a CRM record, prompt log, retrieval index and trained model.

The EDPB's AI-model opinion reinforces the need to assess these issues in context rather than treating every model as automatically anonymous or every processing operation as identical.

AI Use Cases That Create Higher Privacy Risk

Risk and legal obligations depend on implementation, but certain use cases typically justify closer review.

A useful risk test is to ask not only what data enters the AI system, but also what the system can infer, retrieve, expose or decide about an individual.

What About AI Training Data and Personal Data?

Personal data can enter model development through pre-training datasets, fine-tuning data, evaluation datasets, feedback, user interactions or third-party sources.

Using personal data for AI training is not categorically lawful or unlawful, and it does not automatically require consent in every case. The analysis depends on the relevant jurisdiction, data, purpose and legal basis.

Public availability is also not a universal exemption from privacy obligations. In its AI-model opinion, the EDPB identifies whether information was publicly accessible as one consideration when analysing individuals' reasonable expectations in a legitimate-interests assessment. It does not establish a general rule that any publicly accessible personal information is freely available for AI training.

The difference between anonymization and pseudonymization is particularly important. The European Commission explains that pseudonymised data capable of being linked back to an individual remains personal data under GDPR, whereas genuinely anonymous information falls outside the definition.

For AI models themselves, the EDPB takes a case-specific approach. It states that determining whether a model can be considered anonymous requires examining whether individuals whose information was used can be identified and whether their personal data can be extracted from the model through queries.

For training and fine-tuning projects, useful documentation includes data provenance, sources, collection context, intended uses, relevant legal basis, sensitive-data considerations, filtering or minimization measures, retention and contractual rights over third-party datasets.

AI Vendors and Third-Party Tools: What Businesses Should Check

A vendor's privacy policy does not replace the customer's own privacy analysis.

A structured review can help identify where contractual terms, technical behaviour and business expectations do not align.

Where GDPR applies, international transfers outside the EEA may require an appropriate mechanism or safeguard. The European Commission's international-transfer guidance explains mechanisms including adequacy decisions, Standard Contractual Clauses and Binding Corporate Rules.

Vendor representations also matter. The FTC has warned model-as-a-service companies that they need to honour commitments concerning customer privacy and confidentiality, including representations about whether customer information will be used to train or update models.

How AI-Specific Regulation Interacts With Privacy Law

GDPR and the EU AI Act

The GDPR and EU AI Act regulate different, although sometimes overlapping, issues.

The GDPR governs covered processing of personal data. The EU AI Act establishes an AI-specific regulatory framework governing AI systems and models, including prohibited practices, transparency requirements, rules concerning general-purpose AI and requirements for specified high-risk systems.

An organisation can therefore have obligations under both frameworks for the same project. Satisfying one does not automatically demonstrate compliance with the other.

The timeline also requires care. Regulation (EU) 2026/1744 amended Article 113 of the AI Act. Under the current text, Chapter III Sections 1, 2 and 3 apply from December 2, 2027 for systems classified as high risk under Article 6(2) and Annex III, and from August 2, 2028 for systems classified as high risk under Article 6(1) and Annex I, subject to the legislation's detailed provisions. The amended timetable is available directly on EUR-Lex.

Businesses monitoring AI laws and regulations should therefore verify the current consolidated legal text instead of relying on implementation calendars published before the 2026 amendment.

AI Transparency and Privacy Transparency

Article 50 of the AI Act illustrates the distinction between AI transparency and privacy transparency.

The European Commission states that Article 50 transparency obligations began applying on August 2, 2026. They include requirements relating to certain direct interactions with AI, machine-readable marking of specified AI-generated or manipulated content, emotion-recognition or biometric-categorisation systems, deepfakes and specified AI-generated public-interest text. The Commission's Article 50 transparency guidelines explain the current obligations.

For systems placed on the market before August 2, 2026, Regulation (EU) 2026/1744 provides a limited transition for the Article 50(2) marking obligation until December 2, 2026.

These AI disclosures are not substitutes for data-protection notices. A business may need to explain both that an individual is interacting with AI and, separately, how personal data is collected, used, retained, transferred and otherwise processed.

For professionals who want to develop a broader understanding of these overlapping legal frameworks, AI Law & Regulation Essentials Training provides a structured educational next step.

How Businesses Can Build an AI Privacy Compliance Process

A privacy workstream should connect naturally with the organisation's wider AI compliance program, while recognising that privacy compliance and AI compliance are not identical.

1. Inventory AI Systems and Data

Identify AI tools, AI-enabled features, internal models and third-party services.

For each system, document its owner, users, purpose, integrations, data inputs, outputs and affected individuals. Include employee-installed or department-level tools where possible so that "shadow AI" does not fall outside the inventory.

2. Map Applicable Laws

Identify relevant jurisdictions, privacy laws, sector-specific obligations, AI-specific rules and regulator guidance.

Applicability can depend on the organisation's location, the location of individuals, the business sector, statutory thresholds and the role the organisation plays in processing or supplying the AI system.

3. Classify the Data and Use Case

Determine whether the system processes ordinary personal data, sensitive or special-category information, children's data, biometric information, health data or financial information.

Separately identify profiling, monitoring, inference and automated decision-making because those activities can trigger additional scrutiny or requirements.

4. Establish the Legal and Privacy Basis

Document the processing purpose, relevant legal basis where required, necessity, minimization, retention and transparency.

When existing information is being reused for an AI project, reassess whether the new purpose is compatible with the original collection context and whether additional notices, permissions or safeguards are required.

5. Assess AI Vendors and Transfers

Review vendor roles, data-processing terms, training rights, subprocessors, retention, security and international transfers.

Contract language should match actual technical behaviour. If a product setting controls whether customer information is stored or used for model improvement, the operational configuration should also be documented.

6. Assess and Document Higher-Risk Processing

Determine whether the system requires a DPIA, another privacy risk assessment, an AI risk assessment or specific automated-decision safeguards.

Do not assume every AI deployment requires every assessment. Use the trigger established by the applicable legal regime.

Voluntary frameworks can supplement legal analysis. For example, NIST's AI Risk Management Framework is designed to help organisations structure AI risk management, but NIST expressly describes the framework as voluntary rather than a legal requirement. NIST also states that AI RMF 1.0 is currently being revised.

7. Monitor and Update

AI systems, vendor terms, datasets and regulatory rules can change after initial approval.

Organisations should revisit assessments when a model changes, a system gains access to new information, a vendor changes its data-use terms, a new jurisdiction is introduced, an incident occurs or rights requests reveal gaps in existing processes.

Common AI Privacy Compliance Mistakes

AI Privacy Compliance Checklist for Businesses

Completing a checklist does not itself establish legal compliance, but it can help identify questions requiring further assessment.

• Maintain an inventory of AI systems, AI-enabled software and AI vendors.

• Map personal data entering, leaving, retrieved by or generated through each system.

• Identify relevant jurisdictions and applicable privacy regimes.

• Classify sensitive, special-category, biometric, children's, health and financial data where relevant.

• Identify the legal basis for covered processing where required.

• Assess purpose limitation and reuse of existing personal data.

• Minimize unnecessary personal data in prompts, datasets, retrieval systems and logs.

• Check whether privacy notices accurately describe AI-related processing.

• Establish procedures for applicable data-subject requests.

• Review vendor data use, model-training terms, subprocessors, security and retention.

• Assess international data transfers and required safeguards.

• Determine whether a DPIA, privacy risk assessment or other impact assessment is required.

• Assess profiling and automated decision-making requirements.

• Review applicable AI-specific obligations separately from privacy requirements.

• Monitor regulatory, vendor, model, data and system changes.

Conclusion

AI can involve significant personal-data processing, but the applicable obligations depend on the organisation's data, purposes, systems, jurisdictions, vendors and role in the AI supply chain.

Existing privacy laws can apply alongside AI-specific regulation. Businesses therefore need to examine both rather than treating AI compliance as a substitute for privacy compliance or vice versa.

A structured process that inventories AI systems, maps personal data, identifies applicable rules, assesses vendors and higher-risk processing, documents decisions and monitors change can help organisations identify and manage their AI privacy obligations more consistently.

For professionals seeking a broader foundation in the legal frameworks surrounding AI, AI Law & Regulation Essentials Training provides an educational next step for understanding how privacy requirements fit within the wider AI regulatory landscape.