GDPR Basics
Compliance · 6 min
GDPR (German: DSGVO) is the European data protection regulation. It applies to any company processing personal data of EU citizens - regardless of where the company is located.
Key Principles
- Lawfulness: You need a legal basis for processing
- Purpose limitation: Only use data for stated purposes
- Data minimization: Only collect what you need
- Accuracy: Keep data accurate
- Storage limitation: Delete when no longer needed
- Integrity & confidentiality: Secure processing
Legal Bases (Art. 6)
| Basis | Description | AI Example |
|---|---|---|
| Consent | Voluntary, revocable | Newsletter, personalization |
| Contract | Necessary for contract | Order processing |
| Legitimate interest | Balance with data subject rights | Fraud prevention |
Rights of Data Subjects (Art. 15-22)
- Right of access (Art. 15) — What data is processed?
- Right to rectification (Art. 16) — Correct wrong data
- Right to erasure (Art. 17) — "Right to be forgotten"
- Right to restriction (Art. 18) — Stop processing
- Data portability (Art. 20) — Move data to another system
- Right to object (Art. 21) — Object to certain processing
Local AI = GDPR Advantage
- ✅ No third-country transfer — Data stays in EU
- ✅ Full control — You decide who has access
- ✅ No third-country transfer needed — Data stays in the EU (Art. 44 ff. GDPR)
- ✅ Easy documentation — All on your hardware
- ✅ Fast deletion — Physical control over data
Related articles: EU AI Act · Chatbot Transparency
For implementation support, find resources at ai-engineering.at.
Related articles
Compliance
Privacy Practices
Practical implementation — TOM, DPA, documentation, data subject rights.
Compliance
Data Protection Impact Assessment (DPIA)
DPIA for AI systems: When is a Data Protection Impact Assessment required, how to conduct one, and what to document.
Compliance
EU AI Act
Risk classes, prohibitions, transparency requirements for AI systems in the EU.
Was this article helpful?
Continue the learning path
The learning path puts these articles in order, and the Hub carries the building blocks we have checked in our own operations.
Why AI Engineering
- Local and self-hosted
- Documented and verifiable
- From our own operations
- Made in Austria
Not legal advice.