GDPR for AI Systems and Training Data
AI-specific GDPR support: lawful bases for training, scraping, AI DPIAs, automated decisions (Art. 22), Romanian DPA engagement and EDPB opinions on AI.
What we cover
Lawful bases for training
Analysis of legitimate interest, consent and rights balancing for AI training data.
AI DPIAs
Data Protection Impact Assessment for AI systems involving large-scale processing or systematic monitoring.
Web scraping & public data
Legal framework for collecting public data, including EDPB Opinion 28/2024.
Data subject rights
Handling access, rectification, erasure and the 'right to explanation' for AI outputs.
Automated decisions (Art. 22)
Compliance for profiling and decisions producing significant legal effects.
International transfers
SCCs, BCRs, transfer impact assessments for cross-border training and inference.
Applicable legal framework
- §Regulation (EU) 2016/679 — GDPR
- §Romanian Law 190/2018 implementing the GDPR
- §EDPB Opinion 28/2024 on data protection in AI models
- §Relevant decisions of the Romanian DPA (ANSPDCP) and sectoral guidance
- §Articulation with the EU AI Act (Art. 10 — data governance for high-risk AI)
How we work
- 1
AI data flow inventory
We map personal data used for training, fine-tuning, inference and logging.
- 2
Lawful basis assessment
We set the lawful basis for each processing and draft a legitimate interest balancing test.
- 3
DPIA & DPA consultation
We perform the DPIA and, where required, run prior consultation with the authority.
- 4
Documentation & policies
Privacy notices, records of processing, internal policies, processing agreements.
- 5
Incident & request handling
Procedures for data breach response and data subject rights.
Frequently asked questions
Can I use publicly available web data to train an AI model?
Not automatically. EDPB Opinion 28/2024 confirms that public data remains personal data and requires a lawful basis. Legitimate interest may be available but requires a rigorous balancing test, technical safeguards and an opt-out option.
Do I need a DPIA for an AI system?
Almost always for high-impact systems: systematic monitoring, scoring, large-scale processing, sensitive data, automated decisions. The Romanian DPA list makes a DPIA mandatory in many AI scenarios.
What is the 'right to explanation' in an AI context?
GDPR Art. 22 and the EU AI Act create obligations to provide meaningful information about the logic of automated decisions. You do not have to disclose the algorithm, but you must explain factors and offer human contestation.
Related AI services
Need AI legal advice?
Book an initial consultation about AI law and compliance.