Data Privacy Law and AI - GDPR, CCPA, and Automated Decision-Making Cheat Sheet

Updated 2026-07-31

🧠Study flashcards on this topic92 cards · spaced repetition→

Data privacy law sets the legal boundaries for collecting, using, and sharing personal data, and every AI system that touches personal data, from training a model to generating a live recommendation, has to operate inside those boundaries. The stakes are unusually high for AI: an image classifier trained on scraped photos, a hiring algorithm scoring resumes, or a chatbot answering questions about a real person are all "processing" personal data in ways the GDPR and CCPA were never quite written for, which is exactly why regulators have spent the past few years racing to publish guidance that bridges the gap. The insight worth carrying into every table below is that most AI privacy obligations are not new rules invented for AI; they are decades-old principles, lawful basis, minimization, the right to object, applied to a technology that makes them genuinely hard to satisfy: a trained model cannot easily "forget" a name, and a plausible-sounding output is still, legally, a statement about a real person. This sheet stays on the data-privacy side of AI governance, GDPR, CCPA/CPRA, and the mechanics of consent, access, and cross-border transfer, leaving AI Act risk-tier classification and sector-specific rules (healthcare, finance, employment) to their own ground.

What This Cheat Sheet Covers

This topic spans 14 focused tables and 99 indexed concepts, 92 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Core GDPR Principles Applied to AI ProcessingTable 2: Legal Bases for AI Training and DeploymentTable 3: Automated Decision-Making and GDPR Article 22Table 4: Data Subject Rights in the AI LifecycleTable 5: Data Protection Impact Assessments (DPIA) for High-Risk AITable 6: Special Category and Biometric Data in AITable 7: Consent Management for AI Training DataTable 8: CCPA/CPRA and Automated Decision-Making Technology (ADMT)Table 9: US State Privacy Laws and AI Beyond CaliforniaTable 10: Cross-Border Data Transfers for AI Training and InferenceTable 11: Anonymization, Pseudonymization, and Privacy-Enhancing TechniquesTable 12: GDPR and the EU AI Act: Overlap and DivergenceTable 13: Recordkeeping, Governance, and Vendor PracticesTable 14: Landmark Enforcement Actions and Regulatory Precedents

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

The GDPR's foundational principles were written for conventional databases, but they apply in full force to every stage of an AI system's life, from scraping training data to serving a live prediction. Understanding how each principle bites in an AI-specific context is the starting point for everything else on this sheet.

Principle	Example	Description
Purpose limitation	`A dataset collected for fraud detection is later reused to train a general-purpose sentiment model without a compatibility check`	Personal data collected for one declared purpose cannot silently be repurposed to train an unrelated AI model without assessing compatibility under Article 6(4).
Data minimization	`A resume-screening AI ingests only role-relevant fields (skills, experience) rather than a full CV including age or marital status`	• Feed models only the data genuinely necessary for the stated purpose • Applies to training sets and live inference inputs alike
Lawful basis requirement (Article 6)	`A vendor documents which of the six Article 6(1) grounds, consent, contract, legal obligation, vital interests, public task, or legitimate interest, supports each stage of a training pipeline`	Every AI processing operation needs one documented legal ground before it starts, tracked separately for collection, training, and deployment.
Accuracy principle	`A chatbot states an incorrect birthdate for a real person; the individual demands correction under Article 5(1)(d)`	Personal data an AI processes or generates must be kept accurate, an obligation regulators are now actively debating for model outputs, not just training records.
Storage limitation	`Training logs and interaction transcripts containing personal data are purged on a retention schedule rather than kept indefinitely to "improve the model"`	Data, including training sets, embeddings, and logs, should be deleted or anonymized once no longer needed for the AI's stated purpose.
Accountability	`An AI provider maintains a record of processing activities documenting each training dataset's source, legal basis, and retention period`	• Controllers must be able to demonstrate compliance, not just achieve it • Documentation is the first evidence regulators request in an investigation
Data protection by design and by default	`A generative-image system is built with output filters and access restrictions from the design phase, not bolted on after a memorization incident`	Privacy safeguards, minimization, pseudonymization, access controls, must be engineered in from the start of an AI system's development, not retrofitted.
Data Protection Officer (DPO)	`An AI company conducting large-scale profiling of users appoints a DPO with expert knowledge of both data protection law and machine learning practices`	Organizations doing large-scale monitoring or special-category processing, common in AI training, must designate a DPO under Article 37.

Table 2: Legal Bases for AI Training and Deployment

Picking, and documenting, a lawful basis is the first gate any AI processing has to clear, and for large-scale, indiscriminately sourced training data the honest answer is rarely consent. This table works through the bases AI developers actually rely on and what regulators expect from each.

Basis	Example	Description
Legitimate interest (three-part test)	`A platform builds a conversational search agent trained only on data users made manifestly public, with a discretionary opt-out and clear notice`	• Requires a lawful, specific interest, necessity, and a balancing test against individuals' rights • The EDPB and CNIL both confirm it is the most common basis for AI training

The rest of this section is part of the full cheat sheet

Article 22 is the clause most directly aimed at AI: it does not ban automated decisions outright, but it draws a hard line around decisions made "solely" by a machine that meaningfully affect a person's life. Getting the "solely" and "meaningful human involvement" tests right is where most AI compliance programs live or die.

Rule	Example	Description
Right not to be subject to solely automated decisions	`An online lender's algorithm automatically rejects a credit application with no human review`	Individuals have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

The rest of this section is part of the full cheat sheet

Table 4: Data Subject Rights in the AI Lifecycle

Standard GDPR rights, access, correction, deletion, objection, portability, get technically awkward once personal data has been absorbed into a trained model rather than sitting in a retrievable database row. This table covers how each right actually plays out against an AI system.

Right	Example	Description
Right of access for AI-processed data	`A user submits a subject access request asking what personal data a recommendation engine holds and how it influenced a decision about them`	Data subjects can request confirmation of what personal data an AI system processes about them and, where Article 22 applies, meaningful information about the decision logic.

The rest of this section is part of the full cheat sheet

Table 1: Core GDPR Principles Applied to AI Processing

Principle	Example	Description
Purpose limitation	`A dataset collected for fraud detection is later reused to train a general-purpose sentiment model without a compatibility check`	Personal data collected for one declared purpose cannot silently be repurposed to train an unrelated AI model without assessing compatibility under Article 6(4).
Data minimization	`A resume-screening AI ingests only role-relevant fields (skills, experience) rather than a full CV including age or marital status`	• Feed models only the data genuinely necessary for the stated purpose • Applies to training sets and live inference inputs alike
Lawful basis requirement (Article 6)	`A vendor documents which of the six Article 6(1) grounds, consent, contract, legal obligation, vital interests, public task, or legitimate interest, supports each stage of a training pipeline`	Every AI processing operation needs one documented legal ground before it starts, tracked separately for collection, training, and deployment.
Accuracy principle	`A chatbot states an incorrect birthdate for a real person; the individual demands correction under Article 5(1)(d)`	Personal data an AI processes or generates must be kept accurate, an obligation regulators are now actively debating for model outputs, not just training records.
Storage limitation	`Training logs and interaction transcripts containing personal data are purged on a retention schedule rather than kept indefinitely to "improve the model"`	Data, including training sets, embeddings, and logs, should be deleted or anonymized once no longer needed for the AI's stated purpose.
Accountability	`An AI provider maintains a record of processing activities documenting each training dataset's source, legal basis, and retention period`	• Controllers must be able to demonstrate compliance, not just achieve it • Documentation is the first evidence regulators request in an investigation
Data protection by design and by default	`A generative-image system is built with output filters and access restrictions from the design phase, not bolted on after a memorization incident`	Privacy safeguards, minimization, pseudonymization, access controls, must be engineered in from the start of an AI system's development, not retrofitted.
Data Protection Officer (DPO)	`An AI company conducting large-scale profiling of users appoints a DPO with expert knowledge of both data protection law and machine learning practices`	Organizations doing large-scale monitoring or special-category processing, common in AI training, must designate a DPO under Article 37.

Table 2: Legal Bases for AI Training and Deployment

Basis	Example	Description
Legitimate interest (three-part test)	`A platform builds a conversational search agent trained only on data users made manifestly public, with a discretionary opt-out and clear notice`	• Requires a lawful, specific interest, necessity, and a balancing test against individuals' rights • The EDPB and CNIL both confirm it is the most common basis for AI training

Table 3: Automated Decision-Making and GDPR Article 22

Rule	Example	Description
Right not to be subject to solely automated decisions	`An online lender's algorithm automatically rejects a credit application with no human review`	Individuals have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

Table 4: Data Subject Rights in the AI Lifecycle

Right	Example	Description
Right of access for AI-processed data	`A user submits a subject access request asking what personal data a recommendation engine holds and how it influenced a decision about them`	Data subjects can request confirmation of what personal data an AI system processes about them and, where Article 22 applies, meaningful information about the decision logic.