GDPR for AI procurement, what to verify

GDPR establishes a set of principles for processing personal data, any information relating to an identified or identifiable natural person. It requires that personal data be processed lawfully, fairly, and transparently; collected for specified and explicit purposes; kept accurate; stored no longer than necessary; and protected with appropriate technical and organisational security measures.

Every processing operation needs a lawful basis under Article 6. The six available bases are: consent; performance of a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest; and legitimate interests of the controller or a third party. For AI systems, the most commonly relevant bases are legitimate interests and, where the system makes decisions about individuals, sometimes consent. Relying on legitimate interests requires a documented balancing test demonstrating that the interests are not overridden by the individual's rights.

Special category data, covering health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, sex life and sexual orientation, is subject to stricter requirements under Article 9. Processing is prohibited unless one of a defined set of exceptions applies. AI systems that process any of these categories face a higher threshold of justification.

Data subjects hold a set of enforceable rights under Articles 15-22: the right to access their data, the right to rectification, the right to erasure (the 'right to be forgotten' under Article 17), the right to restrict processing, the right to data portability, and in certain cases the right to object to automated decision-making. An AI system that holds personal data in a retrieval index, an embedding store, a training set, or model weights must be able to satisfy a deletion or access request, and a provider who has not worked through how this is done in their architecture has not shipped GDPR-compliant AI.

When you engage a provider to build or operate an AI system that processes personal data on your behalf, that provider is a data processor under Article 4(8). Before any personal data can be disclosed, you must have a Data Processing Agreement (DPA) in place under Article 28, signed by both parties. The DPA must specify the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.

If the processing is likely to result in a high risk to individuals, which includes systematic and extensive automated processing with significant effects, and large-scale processing of special category data, you are required to conduct a Data Protection Impact Assessment (DPIA) under Article 35 before processing begins. Most AI systems that make or inform significant decisions about individuals, or that process health, financial, or behavioural data at scale, will require one.

Cross-border data transfers present a particular structural question for AI builds. If the provider processes data in a country outside the European Economic Area, or if the AI system uses a third-party model or API provider headquartered outside the EEA, an appropriate transfer mechanism under Article 46 must be in place, such as Standard Contractual Clauses. A pipeline that routes personal data to a US-based LLM API without an adequate transfer mechanism in place is not GDPR-compliant, regardless of the parties' intentions.

GDPR has no AI-specific certification to wave. What reveals whether a team has actually shipped under GDPR is the specificity of their answers about data flows. A team that can describe the lawful basis for each processing operation, explain how deletion is honoured across each component of the pipeline, and produce a draft DPA without prompting has done this before. A team that describes GDPR as 'handled' without being able to name the lawful basis has not.

Trustgent's provider profiles include a GDPR readiness attribute that is checked against cross-referenced evidence at L2 and above. Self-declaration earns nothing beyond the claim. Providers who have shipped GDPR-relevant AI builds and had those builds cross-referenced against independent documentation are identifiable in the index. We do not verify legal compliance (that is the role of supervisory authorities) but we do make the difference between claimed and evidenced experience visible to buyers.