The European Data Protection Supervisor's October 2025 guidance on generative AI clarifies GDPR application in ways many organizations haven't addressed.
Key Requirements
Data Protection Impact Assessments
DPIAs are required for high-risk AI processing. Most enterprise AI use cases qualify as high-risk under the guidance.
Purpose Limitation
AI systems must process data only for specified, explicit purposes. Using customer support data to train AI models likely violates purpose limitation without explicit consent.
Data Minimization
Only process data necessary for the AI function. Sending entire documents to AI for summarization when only portions are needed may violate this principle.
Transparency
Individuals must be informed when AI processes their data. This includes informing customers when AI assists with their support tickets.
Automated Decision-Making Rights
Where AI significantly affects individuals, they have the right to human review. This applies to AI-assisted hiring, credit decisions, and similar contexts.
Implementation Steps
1. Inventory all AI systems processing personal data
2. Conduct DPIAs for high-risk processing
3. Update privacy notices to reflect AI usage
4. Implement human review processes for significant decisions
5. Document lawful basis for each AI processing activity
Organizations that address these requirements proactively will be better positioned when enforcement actions increase.
Dr. Foster advises healthcare organizations on HIPAA, FDA, and emerging AI regulations. She previously served as Chief Privacy Officer at a major health system and holds a PhD in Health Informatics.
Stop AI Data Leaks Before They Start
Deploy ZeroShare Gateway in your infrastructure. Free for up to 5 users. No code changes required.
This article reflects research and analysis by the ZeroShare editorial team. Statistics and regulatory information are sourced from publicly available reports and should be verified for your specific use case. For details about our content and editorial practices, see our Terms of Service.