GDPR Basics: The Regulation That Changed Data

GDPR took effect May 25, 2018, regulating personal data of EU residents regardless of where a company is based. Because few large companies can afford to carve out Europe, GDPR effectively became a global standard. California's CCPA, Brazil's LGPD, and India's DPDP Act are all heavily GDPR-inspired.

The six core principles

1. 1Lawfulness, fairness, transparency — you need a lawful basis to process data
2. 2Purpose limitation — collect for a specific purpose, do not quietly repurpose
3. 3Data minimization — only what you need
4. 4Accuracy — keep data correct and up to date
5. 5Storage limitation — delete data when no longer needed
6. 6Integrity and confidentiality — secure the data

What counts as personal data?

Individual rights

• Right to access — see what data is held about you
• Right to rectification — correct wrong data
• Right to erasure (right to be forgotten) — delete your data
• Right to data portability — get your data in a portable format
• Right to object to processing (including automated decision-making)
• Right to withdraw consent

GDPR and AI training

A person can theoretically request deletion of their data from a trained model. Models, however, do not store individual training examples cleanly, making true deletion hard. In 2023, Italy briefly banned ChatGPT over GDPR concerns. OpenAI responded with data controls and opt-outs. This remains a live legal tension.

Practical compliance steps

1. 1Maintain a record of processing activities (Article 30)
2. 2Establish a lawful basis before collecting data
3. 3Write clear privacy notices
4. 4Implement processes for data-subject rights requests
5. 5Conduct a Data Protection Impact Assessment (DPIA) for high-risk use
6. 6Report breaches within 72 hours

The big idea: GDPR made privacy a user right rather than a corporate favor. AI builders must design with these rights from the start, not bolt them on later.