Concept dictionary
Data Privacy / GDPR
Data privacy is the lawful, fair, transparent, and controlled handling of information about people. The GDPR — the European Union's General Data Protection Regulation — is the law that sets out specific rights for individuals and specific obligations for organizations that process personal data within its scope, including organizations based outside the EU that handle the data of people in it.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 3
Also called
- Data Privacy / GDPR
- Data Privacy and GDPR
- GDPR
- Data Privacy
Remember it this wayPersonal data carries duties through every AI handoff.
In plain language
AI systems may collect, receive, infer, store, transform, or expose personal information. Privacy work asks whether that processing has a valid purpose and basis, uses appropriate limits and safeguards, and respects applicable rights.
Why it matters
Data can cross vendors, models, logs, retrieval stores, and outputs. Organizations need current legal and operational analysis before using personal data in an AI workflow.
Example
Before connecting customer records to an AI assistant, a company evaluates purpose, legal basis, minimization, access, retention, vendors, transfers, security, and individual rights.
Common misconception
Removing names does not automatically remove personal-data obligations, and GDPR is not the only privacy law that may apply.
Related terms
Sources
- European Union, General Data Protection Regulationofficial legal text governing personal-data processing in the European Union.
- NIST Privacy Frameworkrisk-based guidance for identifying and managing privacy risk.
Learn more
- Consult current official GDPR and applicable privacy-regulator guidance; begin operationally with [[sensitive-information|Sensitive Information]].