GDPR and AI

Regardless of the risk category of your AI system, GDPR must be followed if your business has any users in the EU/ EEA.

The following elements of GDPR are often particularly relevant to businesses deploying any sort of AI system:

• lawful basis for processing;

• purpose limitation and storage limits;

• special category data processing restrictions;

• automated decision-making;

• profiling and inference of sensitive data

• data protection impact assessments;

• data transfers.

Data Mapping

Data mapping is useful to understand how the data flows through your AI system and interacts with data protection legislation.

Data mapping involves:

• Mapping how your business interacts with personal data during the lifecycle of the AI system you provide/ deploy: Training data → model outputs → deployment.

• Relating each stage to the rights individuals have under GDPR (information/notice, access, rectification, erasure, restrict processing, data portability, objection).

• Ensuring that these rights are preserved at each stage .

Data Mapping in Practice

Practical steps your business can take to ensure your AI use remains compliant with data privacy laws:

• Map your business’s processing of all personal data, including that of users and internal employees

• Review your AI disclosure processes

• Review your internal AI education policy

• Ensure that sufficient human oversight is taking place

• Consider appointing a DPO to help ensure compliance with the legislation

• Consider appointing a Privacy Partner to help ensure equal regulatory compliance and business strategy