Data privacy law sets the legal boundaries for collecting, using, and sharing personal data, and every AI system that touches personal data, from training a model to generating a live recommendation, has to operate inside those boundaries. The stakes are unusually high for AI: an image classifier trained on scraped photos, a hiring algorithm scoring resumes, or a chatbot answering questions about a real person are all "processing" personal data in ways the GDPR and CCPA were never quite written for, which is exactly why regulators have spent the past few years racing to publish guidance that bridges the gap. The insight worth carrying into every table below is that most AI privacy obligations are not new rules invented for AI; they are decades-old principles, lawful basis, minimization, the right to object, applied to a technology that makes them genuinely hard to satisfy: a trained model cannot easily "forget" a name, and a plausible-sounding output is still, legally, a statement about a real person. This sheet stays on the data-privacy side of AI governance, GDPR, CCPA/CPRA, and the mechanics of consent, access, and cross-border transfer, leaving AI Act risk-tier classification and sector-specific rules (healthcare, finance, employment) to their own ground.
What This Cheat Sheet Covers
This topic spans 14 focused tables and 99 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Core GDPR Principles Applied to AI Processing
The GDPR's foundational principles were written for conventional databases, but they apply in full force to every stage of an AI system's life, from scraping training data to serving a live prediction. Understanding how each principle bites in an AI-specific context is the starting point for everything else on this sheet.
| Principle | Example | Description |
|---|---|---|
A dataset collected for fraud detection is later reused to train a general-purpose sentiment model without a compatibility check | Personal data collected for one declared purpose cannot silently be repurposed to train an unrelated AI model without assessing compatibility under Article 6(4). | |
A resume-screening AI ingests only role-relevant fields (skills, experience) rather than a full CV including age or marital status | • Feed models only the data genuinely necessary for the stated purpose • Applies to training sets and live inference inputs alike | |
Lawful basis requirement (Article 6) | A vendor documents which of the six Article 6(1) grounds, consent, contract, legal obligation, vital interests, public task, or legitimate interest, supports each stage of a training pipeline | Every AI processing operation needs one documented legal ground before it starts, tracked separately for collection, training, and deployment. |
A chatbot states an incorrect birthdate for a real person; the individual demands correction under Article 5(1)(d) | Personal data an AI processes or generates must be kept accurate, an obligation regulators are now actively debating for model outputs, not just training records. |