GDPR

What GDPR means in practice

The General Data Protection Regulation is the EU's omnibus data-protection law, in force since 2018. The implications for AI are pervasive: lawful basis for processing applies to model training data, the right to explanation pressures black-box models, cross-border transfer restrictions push inference toward in-region or on-prem deployment, and the data-minimisation principle pushes against indiscriminate prompt logging. The UK GDPR is the post-Brexit equivalent and largely substantively identical. In sovereign AI deployments GDPR compliance is a design constraint, not a post-hoc check — the architecture choice to keep data and model inside the customer's perimeter is what satisfies the cross-border-transfer and processing-control questions.