GDPR Compliance of Processings that Embed Artificial Intelligence
Spain · Guideline · Spanish Data Protection Agency
Our summary
This guideline provides guidance on how to comply with GDPR requirements when using artificial intelligence and machine learning in data processing. It addresses concerns from data controllers, developers, processors and others involved in AI-based processing, covering legal basis, transparency, rights, automated decisions, profiling, privacy impact assessments and proportionality.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
8 sections
Jump to a chapter
I Decision-making based on automated processing
GDPR-compliant AI processing requires trustworthy, continuously evaluated systems supervised by humans with technical security and resilience, respecting data subjects' rights to transparency, access, correction, deletion, objection, and protection from solely automated decisions. AI-based solutions operate through design, development, operation and removal stages, processing personal data at various lifecycle phases including training, validation, deployment and evolution, with controllers, processors and joint controllers responsible for establishing safeguards, clearly defining responsibilities and contractual obligations to ensure compliance. Accountability demands identifying responsible parties, analysing risks, evaluating necessity and proportionality, applying privacy and security protective measures, and providing evidence of effective removal or anonymisation with reidentification risk assessment when AI processes personal data, conducts profiling or makes decisions affecting natural persons affecting access to services or personalization.
II Roles, relationships and responsabilities
Data controllers decide whether and how to conduct processing and bear responsibility for their choices, while processors carry out processing under controller instructions but become controllers if they process independently; the household exception applies to individuals' private use but not when providers supply processing means. Different AI lifecycle stages (development, training, validation, deployment, inference, decision-making, evolution) involve different controllers and processors depending on who decides purposes and uses data, with entities determining system updates based on user data bearing responsibility in evolution stages regardless of data provenance. Controllers must exercise due diligence when acquiring or outsourcing AI development, assess quality specifications, establish processing scope, bear consequences of their decisions, and cannot claim lack of information or technical knowledge to avoid auditing systems or transfer responsibility to the AI system itself.
III Compliance
IV Privacy risks management
V International transfers
Requires GDPR Chapter V safeguards when AI development or deployment involves cross-border data flows to third countries outside the European Economic Area, whether through cloud services, disclosure to third parties for model evolution, or release of components with inherent personal data. Data subjects must be informed of such transfers under GDPR articles 13 and 14, and transfers must be recorded in processing activity logs.
VI Conclusions
Commercialisation of products embedding AI components requires quality and security guarantees regardless of technology novelty or availability; researchers and industry need guidelines for legal certainty. GDPR compliance with AI solutions requires processing maturity enabling objective assessment of compliance and risk management implementation. AI technology may amplify existing ethical deficiencies in society or perpetuate historical bias in data; GDPR application and guarantees minimise such risks.
VII References
VIII Annex: current ai-based services
This annex provides a non-exhaustive list of AI-based services currently deployed across multiple sectors, including human resources, security, transportation, education, public services, healthcare, financial services, and consumer applications, to illustrate the breadth of current AI implementation in data processing.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 11 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 2 of 4
- Data governance and quality, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 3 of 4
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 15 are shown.
II 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Each natural or legal person, public authority or organisation making decisions about personal data processing in any stage of an AI system lifecycle must be identified as a data controller.
- Applies to: ControllerDrafted by the Index
A data controller may outsource tasks to third parties who carry them out as processors under the controller's instructions and within the purposes the controller has determined.
III 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Before designing a processing activity that uses an AI-based solution, the controller must identify and establish a legitimate legal ground for the personal data processing.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must ensure that a processing activity involving AI satisfies a minimum set of GDPR conditions: lawful grounds, transparency toward data subjects, mechanisms for exercising subject rights, accountability with documented risk management, and compliance with international transfer rules.
- ObligationApplies to: ControllerDrafted by the Index
Each stage of an AI system lifecycle, such as training, validation, inference and service delivery, must be assessed for whether it requires different legitimate legal grounds and compliance measures.
IV 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Organizations must conduct continuous management of privacy risks as part of their accountability obligations under GDPR, adopting a documented data protection policy proportional to their processing activities.
- ObligationApplies to: ProviderDrafted by the Index
Organizations must identify threats and assess the inherent level of risk present in their processing, then implement appropriate and proportional technical and organizational measures to remove or mitigate that risk.
- ObligationApplies to: ProviderDrafted by the Index
When determining the risk level of a processing involving an AI component, organizations must account for risks from bias and algorithmic discrimination in decision-making systems and risks from broader social context and collateral effects of the processing.
V 4 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers and controllers must apply GDPR Chapter V safeguards when AI development or deployment involves cross-border data flows to third countries outside the European Economic Area through cloud services, disclosure to third parties, or release of components with inherent personal data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must establish mechanisms to manage contracts in cross-border AI transfers, ensuring they have sufficient information about contractors and retain decision-making power.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must inform data subjects of international transfers under GDPR Articles 13 and 14.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must record international transfers of personal data in processing activity logs.
VI 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Organisations must implement quality and security guarantees when offering AI-based processing solutions to entities and consumers, rather than relying on the technology's novelty or availability.
- ObligationApplies to: ProviderDrafted by the Index
AI solutions must reach a level of maturity that permits objective evaluation of whether data processing complies with the GDPR and whether risk management safeguards are implemented.
- ObligationApplies to: DeployerDrafted by the Index
Organisations must be cautious not to assign decision-making duties to unsupervised AI components without applying rational, critical and discerning judgment about how the technology will be used.
Change history
No changes recorded since we began monitoring this policy.