Regulation (binding Union law)
EU General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679 is the Union’s general data-protection law. It is not an AI statute, but it governs personal-data processing that many AI systems require, including rules on lawfulness, purpose limitation, data-protection impact assessments, and automated individual decision-making in Article 22. AI compliance analyses that ignore the GDPR are incomplete in the EU context. It remains distinct from the AI Act.
Last reviewed 2026-08-22
- Issuer
- European Union
- Year
- 2016
- Status
- In force
- Geographic scope
- European Union, Extra-territorial effects as defined in the GDPR
- Official source
- Official text (opens in a new tab)