The General Data Protection Regulation, Regulation (EU) 2016/679, is the European Union's framework for the protection of personal data. Adopted on 27 April 2016 and effective from 25 May 2018, it governs the processing of personal data of individuals in the EU and EEA and applies extraterritorially to processing of EU residents' data regardless of where the processor is located. Its full title is "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data."
Scope and definitions
The regulation applies across the EU/EEA and reaches processors outside the bloc when they process the personal data of EU residents, giving it extraterritorial effect. It establishes a principles-based regime built on data minimization and purpose limitation, under which personal data must be adequate, relevant, and limited to what is necessary for the stated purpose.
A higher standard applies to special category data, which includes health, biometric, genetic, racial or ethnic, religious, political, and sexual-orientation data, addressed in Article 9.
Key provisions
Processing requires a lawful basis under Article 6, drawn from consent, contract, legal obligation, vital interests, public task, or legitimate interest. The regulation grants individuals rights of access, rectification, erasure (the "right to be forgotten"), data portability, objection, and restriction of processing, along with rights regarding automated decision-making under Article 22. Controllers must conduct Data Protection Impact Assessments (DPIAs) for high-risk processing, and Article 25 requires data protection by design and by default.
Obligations by actor
Controllers and processors are supervised by national data protection authorities (DPAs). For cross-border processing, a "one-stop shop" mechanism designates a lead supervisory authority. The DPAs most active in the AI context are the DPC (Ireland), the lead supervisor for most major US technology companies (Meta, Google, OpenAI, Apple, Microsoft) because their EU headquarters are located in Ireland; the CNIL (France), active in AI-specific guidance and enforcement; and the ICO (UK), which administers the UK GDPR post-Brexit, a regime that remains substantially equivalent.
Enforcement and penalties
For the most serious violations, penalties can reach €20M or 4% of global annual turnover, whichever is higher.
The European Commission's EU KIDS Act proposal of 17 September 2026 would make the GDPR's supervisory authorities competent to monitor the personal-data processing its age-assurance provisions require, and to fine infringements of those data-protection obligations under Article 83 up to the amount in Article 83(5). The proposal states that it is without prejudice to the GDPR's purpose-limitation and data-minimisation principles, requires age assurance to process no more data than strictly necessary and to be "zero knowledge proof," and provides that where a social networking or video-sharing service relies on consent as its legal basis, its minimum age of 15 applies in parallel with the GDPR's Article 8 age limits for children's consent (Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary).
Application to AI
The GDPR's interaction with AI raises several recurring compliance questions. Personal data contained in training corpora requires a lawful basis, and reliance on the legitimate-interest and public-interest bases for this purpose is contested. Article 22, which creates rights against decisions based solely on automated processing that produce significant effects, has a contested application to large language models. In OQ v Land Hessen (SCHUFA Holding (Scoring), Case C-634/21, 2023), the Court of Justice held that a credit-scoring probability value used by a bank to inform a loan refusal is itself a decision based solely on automated processing, and set three cumulative conditions: a decision, based solely on automated processing including profiling, producing legal or similarly significant effects. Ana Beduschi applies those conditions across a six-level model of agentic autonomy and concludes that Article 22(1) is engaged at every level except full human control — including where an agent seeks human approval or consults a human before deciding — while arguing that the regulation's controller-processor allocation survives agentic deployment intact, since only natural or legal persons can be controllers (Data protection in the era of agentic artificial intelligence (Beduschi)). She notes that the Digital Omnibus proposed in November 2025 could expand the lawful grounds for automated decisions, particularly on contractual necessity, while leaving the definition of a decision "based solely on automated processing" to existing case law. The transparency requirements of Articles 13 and 14, together with DPIA obligations, drive demand for interpretable AI. On cross-border transfers, the Schrems II ruling (2020) invalidated the Privacy Shield framework, leaving Standard Contractual Clauses (SCCs) as the primary mechanism for EU-to-US transfers.
Article 22 enforcement: the Uber driver-deactivation fine
The Autoriteit Persoonsgegevens, the Dutch data protection authority, imposed a fine of €824,990,000 on Uber in a decision dated August 17, 2026 and announced August 21 — the second-largest penalty issued under the regulation to date, and the authority's fourth against the company. Between 2018 and 2022, Uber software tracking driving behaviour and customer reviews automatically deactivated drivers' accounts, temporarily on suspicion of fraud or low ratings and permanently where ratings stayed low, without human assessment. The authority ruled this a violation of the prohibition on fully automated decision-making and found that Uber did not sufficiently inform drivers about it. Deputy chair Monique Verdier said drivers "were deactivated without pardon" and that "a computer should not make decisions on its own that have major consequences for you." Fines are capped at 4% of worldwide annual turnover; Uber's global turnover was around €44.5 billion in 2025. Uber said it strongly disagrees with the decision and the fine, said its policies include human reviews and a route to dispute suspensions, and has appealed (Source: autoriteitpersoonsgegevens.nl; theguardian.com).
The decision applies Article 22 to an operational workforce-management system rather than to a credit or scoring decision, and rests on the absence of human assessment in the deactivation loop. See Algorithmic Accountability and Bias Audits, Human Oversight.
Relationships
- regulated-by: Irish Data Protection Commission (DPC), CNIL (Commission nationale de l'informatique et des libertés), UK Information Commissioner's Office (ICO), Autoriteit Persoonsgegevens — primary enforcement bodies
- related: EU AI Act (Regulation 2024/1689) — sector-specific AI regulation layered on top of GDPR
- related: AI Copyright Litigation — Analysis — GDPR-adjacent data-rights questions for training data
- related: Algorithmic Accountability and Bias Audits, Human Oversight — the Article 22 human-assessment requirement as applied in the 2026 Uber decision
- related: AI Compliance Industry / Regulatory Fragmentation — GDPR as one of multiple overlapping compliance regimes
- related: EU KIDS Act (proposed Regulation on the protection of minors online), Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary — proposed Regulation whose age-assurance data processing GDPR authorities would supervise