The Core Principles of GDPR
GDPR is built on seven principles that govern all personal data processing. Lawfulness, fairness, and transparency requires that you process data with a valid legal basis and are open with individuals about what you do with their data. Purpose limitation means you collect data for specific, explicit purposes and do not process it for other purposes without a new legal basis. Data minimisation requires collecting only the data necessary for the specified purpose. Accuracy means keeping personal data up to date. Storage limitation means not keeping personal data longer than necessary. Integrity and confidentiality requires appropriate technical and organisational security measures to protect data. Accountability means being able to demonstrate compliance, not just claim it. For AI products, these principles create specific obligations: you must be transparent about AI processing (transparency), you must not use personal data to train models without a valid legal basis (purpose limitation), and you must implement appropriate security around AI systems that process personal data (integrity and confidentiality).
Legal Bases for Processing Personal Data
Every instance of personal data processing must have a legal basis under GDPR. There are six: consent (the individual has given clear consent for a specific purpose), contract (processing is necessary to perform a contract with the individual), legal obligation (processing is required by law), vital interests (necessary to protect someone's life), public task (necessary to perform a public authority function), and legitimate interests (processing is necessary for your legitimate interests or those of a third party, except where overridden by the individual's rights). For AI products, the most commonly applicable bases are consent (for optional data processing, such as using interaction data to improve AI models), contract (for processing data necessary to provide the service the user has signed up for), and legitimate interests (for analytics and product improvement, where the impact on individuals is low and proportionate). Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and bundled consent do not count under GDPR. For AI training on user data, explicit and granular consent is typically required because the purpose is different from the core service delivery.
AI-Specific GDPR Obligations
AI products face specific GDPR obligations that standard SaaS products do not encounter to the same degree. Automated decision-making provisions under Article 22 require that individuals have the right not to be subject to a decision based solely on automated processing if that decision produces legal or similarly significant effects. This applies to AI systems that make credit decisions, CV screening decisions, or similar high-stakes determinations. Where automated decision-making is used, you must inform individuals, provide a right to human review, and explain the logic involved. Data Protection Impact Assessments (DPIAs) are mandatory under GDPR before implementing AI systems that are likely to result in high risk to individuals, which includes large-scale processing of special categories of data, systematic monitoring, and new technologies where the privacy impact is unclear. For UK products, the ICO's guidance on AI and data protection provides specific direction on how GDPR applies to AI development and deployment.
Data Subject Rights and AI Products
GDPR grants individuals eight rights that your AI product must support. The right to be informed (covered by your privacy notice). The right of access (subject access requests: individuals can ask for all personal data you hold about them, and you must respond within one month). The right to rectification (correcting inaccurate data within one month). The right to erasure (deleting personal data in specified circumstances, within one month). The right to restrict processing. The right to data portability (providing data in a machine-readable format). The right to object (including to automated decision-making). Rights related to automated processing. For AI products, right to erasure creates specific technical challenges. Personal data in relational databases can be deleted with a SQL statement. Personal data in vector databases (embeddings generated from user documents) requires careful implementation: you must delete the embeddings, which may require re-embedding remaining documents without the deleted user's data. Personal data in fine-tuned model weights is harder still: fine-tuning on personal data creates a legal obligation to be able to address erasure requests, and the technical approach (cryptographic erasure, model retraining, or differential privacy) should be decided at design time, not when a request arrives.
GDPR for AI Products Using LLM APIs
When your AI product sends user data to a third-party LLM API (OpenAI, Anthropic, Google), that LLM provider is processing personal data on your behalf. Under GDPR, this makes the LLM provider a data processor and requires a Data Processing Agreement (DPA) between you and them. Most major LLM providers have DPAs available: OpenAI's data processing addendum, Anthropic's data processing agreement, and Google's DPA all exist and are accessible through their platform documentation. You must execute these DPAs before sending personal data to these APIs. Your own privacy notice must disclose that you use these providers as sub-processors. Data minimisation applies here too: you should only send to the LLM the personal data necessary for the task. If a user uploads a document that contains names and contact details that are not relevant to the AI analysis being performed, consider stripping or pseudonymising that data before it reaches the LLM API. SpeedMVPs implements data minimisation at the prompt construction layer as a standard practice in every AI MVP.
ICO Enforcement and Practical Compliance
In the UK, the Information Commissioner's Office (ICO) enforces UK GDPR. The ICO has demonstrated willingness to fine organisations for serious data protection failings: British Airways received a GBP 20 million fine for a data breach, Marriott received a GBP 18.4 million fine, and numerous smaller organisations have received fines for failures in consent management, data security, and data retention. For AI products, the ICO has published specific guidance on AI and data protection, including a toolkit for auditing AI systems. Practical compliance means having a clear privacy notice that accurately describes your data processing, obtaining appropriate consent where required, executing DPAs with LLM providers and other sub-processors, conducting DPIAs for high-risk AI processing, maintaining a Records of Processing Activities (ROPA) document, implementing technical measures for data subject rights, and having an incident response process for data breaches. For UK AI products at MVP stage, SpeedMVPs includes GDPR-aware data architecture and key compliance documentation as part of the build, making ICO compliance achievable from day one without a dedicated legal team.