# Data protection law and AI > How data protection law applies to AI wherever you operate: lawful basis, minimisation, automated decisions, deletion, and residency by architecture. - Web page: https://www.alesanalytics.com/explainers/data-protection-and-ai - Markdown: https://www.alesanalytics.com/explainers/data-protection-and-ai.md - Last updated: 2026-09-18 - Publisher: Ales Analytics Why where the model runs, and what it reads, decides your obligations. ## In one paragraph Data protection law decides what an AI system is allowed to do with personal data: what it can be trained on, what it can read at the moment it answers a question, and what happens when someone asks for their data to be deleted. Most jurisdictions where organisations operate now have a comparable law, built around similar ideas even where the detail differs. Two design choices decide most of the risk: where the model runs, and whether personal data sits inside the model itself or in a separate store the model reads at question time. ## Who it applies to Any organisation that processes personal data, in the ordinary sense most organisations already understand from outside AI. The European Union's General Data Protection Regulation, in force since 25 May 2018, applies to any organisation processing the personal data of people in the EU or EEA, wherever that organisation is based, and it applies in full to AI systems: the lawful basis for using data to train or run a system, data minimisation, purpose limitation, rights around decisions made solely by automated means, and impact assessments for higher-risk processing. The United Kingdom applies UK GDPR alongside the Data Protection Act 2018, with guidance on AI published by the Information Commissioner's Office; there is no standalone UK AI statute as of September 2026. Japan's Act on the Protection of Personal Information applies to the personal data of individuals in Japan. Singapore's Personal Data Protection Act 2012 applies there. India's Digital Personal Data Protection Act 2023, with Rules notified on 14 November 2025, is a consent-based law covering the personal data of individuals in India. Most other jurisdictions organisations operate in now have a broadly comparable law. ## What it asks for - A lawful basis for the personal data an AI system is trained on and the data it reads when it answers a question. - Data minimisation: using only the personal data a system actually needs, rather than everything available. - Purpose limitation: using personal data for the purpose it was collected for, not a new one an AI system happens to make possible. - Rights for the person concerned around decisions made solely by automated means, including a route to a human review. - An impact assessment before higher-risk processing begins, covering what the system does and what could go wrong. - A workable answer to a deletion request, which is far easier to give when personal data sits in a store the system reads rather than inside the model itself. ## What it looks like in practice Consider a system that answers customer questions by reading account records at the moment it is asked. Because the personal data lives in the account records rather than inside the model, a deletion request is answered by deleting the record, in the same way any other system in the organisation would answer it, rather than by a difficult conversation about whether the model itself has to be retrained. ## Where it stands now The EU GDPR has applied since 25 May 2018. The UK applies UK GDPR and the Data Protection Act 2018, with Information Commissioner's Office guidance on AI, and has no standalone AI statute as of September 2026. India's Digital Personal Data Protection Act 2023 became operational with Rules notified on 14 November 2025. Dates change; the official text linked below is the authority. ## How this connects to our work Keeping personal data out of the model's weights, in a store it reads at question time, and running that store inside your own environment, is how [private AI infrastructure](https://www.alesanalytics.com/capabilities/private-ai-infrastructure) and [knowledge systems](https://www.alesanalytics.com/capabilities/knowledge-systems) are built. See also [security controls for private AI](https://www.alesanalytics.com/docs/security-controls-for-private-ai). ## Read the original 1. [Regulation (EU) 2016/679, the General Data Protection Regulation](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng). European Union, 2016. Applies fully to AI systems that process personal data. 2. [Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/). UK Information Commissioner's Office, 2025. How UK data protection law applies to AI. 3. [Act on Promotion of Research, Development and Utilisation of AI-Related Technologies](https://www.japaneselawtranslation.go.jp/en/laws/view/5066/en). Government of Japan, 2025. A framework law in force since September 2025, with no penalty regime. 4. [Digital Personal Data Protection Act 2023 and Rules 2025](https://www.meity.gov.in/data-protection-framework). Ministry of Electronics and Information Technology, India, 2025. Consent-based data protection law, operational since the 2025 Rules. 5. [Model AI Governance Framework](https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework). IMDA and PDPC, Singapore, 2024. Voluntary framework, with a 2024 generative-AI edition. ## Contact solutions@alesanalytics.com, or https://www.alesanalytics.com/contact. - Every page as Markdown: https://www.alesanalytics.com/llms.txt