GDPR

« Back to Glossary Index

GDPR (General Data Protection Regulation)

Definition

The General Data Protection Regulation (GDPR) is a European law that has been directly applicable in all member states since May 25, 2018. Its aim is to protect the fundamental rights of natural persons when handling personal data and at the same time to enable the free movement of data within the Union. It defines comprehensive requirements for lawfulness, Transparency, Earmarking, data economy, accuracy, storage limitation, Integrity, Confidentiality and accountability. The regulation affects all organizations - including those outside the EU - that process the data of EU citizens. For AI governance, the GDPR of central importance, as it provides the legal framework within which AI systems personal data are allowed to use. Violations can result in severe fines.

Basic principles

  • Legality, fairness, Transparency: Data may only be processed on a legitimate basis, and Affected parties need to know how their data is being used.
  • Earmarking and minimization: Only data that is required for a specific purpose may be recorded and this purpose may not be changed subsequently.
  • Correctness and memory limitation: Data must be correct and will only be stored for as long as necessary.
  • Integrity and Confidentiality: They are Technical and organizational measures to protect data from unauthorized access.
  • Accountability: Responsible persons must be able to demonstrate that they comply with these principles.

Practical example

An online store needs a customer's address in order to deliver an order. This Processing is necessary for the performance of the contract and is therefore permissible. If the store wishes to use the e-mail address later for advertising messages, the GDPR a clear Consent. A double opt-in procedure ensures that only registered recipients are contacted.

Significance for AI

  • AI systems that personal data must have a legal basis and must comply with the Rights of data subjects true.
  • Privacy by design and privacy by default apply during the development and use of AI applications.
  • In the event of a high risk, a data protection impact assessment (DPIA) must be carried out and documented.

Steps towards compliance

  • Data inventory and Legal basis: Record all data processing and document purposes and authorization.
  • Transparent communication: Update data protection notices and enable the Revocation of consents.
  • Rights of data subjects implement: Create processes for information, Correction, Deletion and data portability.
  • Security: Implement technical measures such as Encryption, access restrictions and regular updates.
  • Continuous monitoring: Carry out regular assessments, document processes and update measures.
« Back to Glossary Index
administrator