Do AI Companies Have to Comply With GDPR?

GDPR Follows the Data, Not the Company’s Address

The General Data Protection Regulation, widely known as the GDPR, is the European Union’s comprehensive data protection law, and its reach is defined by whose personal data is being processed rather than where the company processing it happens to be based. This means an AI company doesn’t need offices or servers in the EU to fall under GDPR obligations — what matters is whether it’s processing the personal data of people located in the EU, such as by offering a product or service to them or monitoring their online behavior.

Given how many AI products are available globally over the internet, this extraterritorial reach means most AI companies with any meaningful international user base need to at least evaluate whether GDPR applies to some portion of their operations, even if their primary market and headquarters are elsewhere.

Why AI Specifically Raises Distinct GDPR Questions

GDPR was written broadly enough to apply to any processing of personal data, but AI systems have raised some genuinely novel compliance questions within that existing framework. Training a large AI model often involves processing enormous datasets, and if any of that data includes personal information about identifiable people located in the EU, questions arise about what legal basis justifies that processing, how individuals can exercise rights like access or correction over data embedded somewhere in a massive training set, and how a right to deletion can be meaningfully honored once someone’s data has already contributed to a trained model rather than sitting in a simple retrievable database record.

GDPR also includes provisions addressing automated decision-making that significantly affects individuals, which is directly relevant to AI systems used for things like credit decisions, hiring screening, or insurance pricing. These provisions generally give individuals certain protections and rights when significant decisions about them are made through largely automated processes, adding another layer AI companies operating in this space need to account for beyond general data protection principles.

Because AI development often involves large-scale data collection and processing patterns that weren’t necessarily anticipated when GDPR was originally drafted, regulators, courts, and companies have continued working through exactly how established GDPR principles apply to specific AI practices — an ongoing process rather than a single settled body of clear-cut answers for every scenario.

What Compliance Looks Like in Practice

For an AI company handling data from EU-based users, practical GDPR compliance generally involves steps like establishing and documenting a lawful basis for processing personal data, being transparent with users about what data is collected and how it’s used, building mechanisms to honor individual rights requests such as access or deletion, implementing appropriate security measures to protect personal data, and, for higher-risk processing, conducting data protection impact assessments. Companies operating in this space often work with dedicated data protection or privacy compliance functions specifically because getting this right requires ongoing, specialized attention rather than a one-time setup.

Bottom Line

AI companies generally do have to comply with GDPR if they process personal data belonging to people located in the EU, regardless of where the company itself is headquartered, and AI-specific practices like large-scale training data collection and automated decision-making have raised additional compliance questions that companies, regulators, and courts continue to work through under the existing GDPR framework.