Data protection law and AI

In one paragraph

Data protection law decides what an AI system is allowed to do with personal data: what it can be trained on, what it can read at the moment it answers a question, and what happens when someone asks for their data to be deleted. Most jurisdictions where organisations operate now have a comparable law, built around similar ideas even where the detail differs. Two design choices decide most of the risk: where the model runs, and whether personal data sits inside the model itself or in a separate store the model reads at question time.

Who it applies to

Any organisation that processes personal data, in the ordinary sense most organisations already understand from outside AI. The European Union's General Data Protection Regulation, in force since 25 May 2018, applies to any organisation processing the personal data of people in the EU or EEA, wherever that organisation is based, and it applies in full to AI systems: the lawful basis for using data to train or run a system, data minimisation, purpose limitation, rights around decisions made solely by automated means, and impact assessments for higher-risk processing. The United Kingdom applies UK GDPR alongside the Data Protection Act 2018, with guidance on AI published by the Information Commissioner's Office; there is no standalone UK AI statute as of September 2026. Japan's Act on the Protection of Personal Information applies to the personal data of individuals in Japan. Singapore's Personal Data Protection Act 2012 applies there. India's Digital Personal Data Protection Act 2023, with Rules notified on 14 November 2025, is a consent-based law covering the personal data of individuals in India. Most other jurisdictions organisations operate in now have a broadly comparable law.

What it asks for

• A lawful basis for the personal data an AI system is trained on and the data it reads when it answers a question.
• Data minimisation: using only the personal data a system actually needs, rather than everything available.
• Purpose limitation: using personal data for the purpose it was collected for, not a new one an AI system happens to make possible.
• Rights for the person concerned around decisions made solely by automated means, including a route to a human review.
• An impact assessment before higher-risk processing begins, covering what the system does and what could go wrong.
• A workable answer to a deletion request, which is far easier to give when personal data sits in a store the system reads rather than inside the model itself.

What it looks like in practice

Consider a system that answers customer questions by reading account records at the moment it is asked. Because the personal data lives in the account records rather than inside the model, a deletion request is answered by deleting the record, in the same way any other system in the organisation would answer it, rather than by a difficult conversation about whether the model itself has to be retrained.

Where it stands now

The EU GDPR has applied since 25 May 2018. The UK applies UK GDPR and the Data Protection Act 2018, with Information Commissioner's Office guidance on AI, and has no standalone AI statute as of September 2026. India's Digital Personal Data Protection Act 2023 became operational with Rules notified on 14 November 2025. Dates change; the official text linked below is the authority.

How this connects to our work

Keeping personal data out of the model and in a store it reads at question time, and running that store inside your own environment, is central to how we build a private AI setup, and to the governed knowledge layer the model reads from.