GDPR
Regulation (EU) 2016/679 (General Data Protection Regulation)
Foundational EU data protection law with direct AI enforcement precedent. Article 22 restricts automated decision-making; Article 9 classifies mental health data as special category requiring explicit consent; Article 8 sets children's consent thresholds (13-16 by member state).
Jurisdiction
European Union
Enacted
Apr 27, 2016
Effective
May 25, 2018
Enforcement
EU/EEA Data Protection Authorities + EDPB coordination
Why It Matters
The Replika enforcement (€5M, May 2025) establishes companion AI processes special category health data. Italian DPA found "confidant, therapist, romantic partner" positioning requires enhanced protections. This reasoning applies EU-wide.
Recent Developments
Italy Garante fined OpenAI €15M (Dec 20, 2024). Garante fined Replika €5M (decision Apr 10, 2025; announced May 19, 2025)—among the first major companion AI enforcement actions. EDPB Opinion 28/2024 addresses AI model training.
At a Glance
Who Must Comply
- Controllers/processors handling EU personal data
- Non-EU entities processing EU residents' data (extraterritorial)
Safety Provisions
- Article 22: Right not to be subject to decisions based solely on automated processing with legal/significant effects
- Article 9: Mental health data is "special category" requiring explicit consent
- Article 8: Children's consent threshold 13-16 years (varies by member state); parental consent below
- Articles 13/14: Transparency about automated decision-making logic, significance, consequences
- Article 35: DPIA required for high-risk processing (health data, systematic monitoring)
- Data protection by design and by default
- Data subject rights (access, deletion, objection, portability)
- Security + 72-hour breach notification
Compliance & Enforcement
Penalties
€20M or 4% revenue (whichever higher)
Private Right of Action
Individuals can sue directly without waiting for regulatory action.
Primary Source
EUR-Lex
https://eur-lex.europa.eu/eli/reg/2016/679/oj
View on map
European Union
Focus Areas
Cite This
APA
European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation).
Related Regulations
EU PLD
Modernized product liability framework explicitly covering AI systems and software as products. Shifts burden of proof in complex AI cases, allows disclosure orders for technical documentation, and addresses liability for AI-caused harm including through software updates.
EU CRA
Mandatory cybersecurity requirements for all products with digital elements placed on the EU market, including AI software. Requires security by design, vulnerability handling, incident reporting to ENISA, software bills of materials, and CE marking for market access.
Switzerland FADP
Switzerland's revised data protection law with Article 21 automated decision transparency requirements, human review rights, and fines up to CHF 250,000.
Portugal Digital Rights Charter
Portugal's Charter of Digital Rights with Article 9 requiring AI to respect fundamental rights and establishing algorithmic auditability principles.
Serbia PDP Law
Serbia's GDPR-aligned data protection law with profiling safeguards and DPIA requirements.
Italy D.Lgs. 160/2026
First of two legislative decrees implementing Italy's AI law (Law 132/2025) and adapting national law to the EU AI Act. Title I sets the first organic rules for police use of AI systems on a human-oversight basis, including exceptional, time-limited and judicially authorised real-time biometric identification and a ban on biometric databases built by untargeted mass scraping of the web. Title II introduces Penal Code Article 437-bis, punishing failure to adopt security measures in high-risk AI systems and their unlawful alteration, and gives claimants procedural tools for damages caused by AI systems: access to the system's technical documentation, a presumption of causal link, an alternative forum near the claimant's residence and direct action against the insurer.
Last updated February 17, 2026. Verify against primary sources before relying on this information.