GDPR for AI Training Data: Legal Bases and Compliance Checklist

Imagine you’re building a support chatbot. You already have years of help desk tickets with thousands of real questions and answers. This is ideal material to train on, so you export all of it and feed it to a model.

But those tickets are full of personal data, like names, email addresses, and phone numbers. And, depending on what business you’re in, potentially personal data that’s even more sensitive.

If you have EU-based customers, the General Data Protection Regulation (GDPR) applies the moment all of that goes into training, regardless of whether you built the chatbot yourself or you're using a vendor's tool.

The GDPR defines data processing very broadly, but it applies to every stage of an AI data lifecycle. This includes sourcing your training data, building the model, and running it in production. 

The regulation’s requirements get clearer once you break them down stage by stage, which is what this guide does. It covers how the GDPR treats AI training data, which legal bases you can rely on when you source it, and a checklist to work through when working with personal data and AI tools.

Does The GDPR Apply to AI Training Data?

The GDPR applies whenever the personal data of people located in the EU/EEA is processed as part of an AI system. This covers the entire lifecycle: collection, training, inference, and output. 

Art. 4 GDPR defines processing so broadly that almost any operation using personal data falls under the rules, from the first export of a training dataset to the model's responses in production.

The European Data Protection Board (EDPB) confirmed this in its Opinion 28/2024, which addresses both the development and the deployment of AI models. A model trained on personal data won’t necessarily be exempt from the rules once training ends, since data can sometimes be extracted or inferred from it later.

The challenge for most teams is determining what exactly qualifies as personal data. Under Art. 4 GDPR, this reaches well beyond names and email addresses, extending to “an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

In an AI setting, that routinely includes:

• Behavioral logs such as clickstream, session, and usage data
• Prompt and conversation histories tied to a user or account
• IP addresses and other online identifiers, which Recital 30 names as personal data
• Any field that, alone or combined with other data you hold, can be traced back to a person

When Is a DPIA Required for AI Training Data?

Art. 35 GDPR requires a Data Protection Impact Assessment (DPIA) before conducting any processing likely to cause high risk to individuals. Training data can definitely fit under this umbrella, especially when an AI system profiles individuals, processes personal data at scale, or requires special category data safeguards.

If your training data ticks any of these boxes, it’s best to assume you need a DPIA. Under the EU's Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 27, 2026), the deadline for Annex III high-risk AI obligations, including the Article 27 fundamental rights impact assessment, has been pushed from August 2, 2026 to December 2, 2027.

Is Publicly Available Data Exempt From GDPR Regulations on AI Training?

Public availability doesn’t take data outside the scope of the GDPR. If information relates to identifiable people, scraping it for AI training is still processing, and it still needs a lawful basis.

The Dutch DPA’s EUR 30.5 million GDPR fine against Clearview AI made this clear. The American facial recognition platform was penalized for building a database from billions of publicly scraped images with no valid legal basis. 

In another example, the Irish DPC forced social media platform X to stop feeding EU users' public posts to Grok for training and to delete that data.

What Legal Basis Can You Use for AI Training Data?

Before you process any personal data to train a model, Art. 6 GDPR requires you to identify and document a valid legal basis for doing so. And there’s no exception for AI training purposes.

For most AI training, four of the six legal bases are worth focusing on:

Consent: Individuals actively agree to their data being used

Legitimate interest: You rely on a documented balancing test

Contractual necessity: The training is needed to deliver a service the person signed up for

Legal obligation: The law requires you to process data

The rest of this section takes a closer look at each one and explains when it fits, what it requires, and where it tends to fall short for AI training.

But one rule cuts across all of them: you can’t swap legal bases after the fact, so identify and document your basis before processing starts. Deciding retroactively or switching after you start processing data won’t hold up under GDPR compliance requirements.

Consent

Consent is the clearest basis to rely on, but it’s often the hardest to scale. When someone actively agrees to their data being used to train your model, the legal position is easy to explain and easy to defend.

But the GDPR has very specific guidelines around consent. Under Art. 4 GDPR, consent has to be freely given, specific, informed, and unambiguous. 

For AI training, that means the purpose of the data processing has to be named at the point of collection. A general line in your terms of service about "improving our services" won’t cover it, and if you didn’t tell people their data would train an AI model when you collected it, that consent doesn’t stretch to cover this specific purpose.

Consent works best when the dataset is small and you have a direct relationship with the people in it, for example current customers who opt in to help improve a feature. It becomes impractical at scale or for historical data, where going back to thousands of people for specific, informed approval is rarely realistic.

Legitimate interest

For most AI training, legitimate interest is the basis you’re most likely to rely on, and it’s the one the EDPB addressed most directly in Opinion 28/2024. This Opinion confirmed that legitimate interest under Art. 6(1)(f) GDPR can support both the development and the deployment of AI models, but it also made clear that the basis is never automatic.

To rely on it, you need to complete and document a three-step Legitimate Interest Assessment (LIA):

Identify the interest: It has to be lawful, clearly defined, and real rather than speculative, e.g., building a chatbot to speed up customer support tickets.

Show necessity: The processing has to be necessary to achieve that interest, with no less intrusive way to get there and no more data than the purpose requires.

Balance it out: Weigh your interest against the data subjects’ rights and freedoms taking account of how they would reasonably expect you to handle their information.

The EDPB is explicit that you can’t assume legitimate interest as a default. And a documented LIA is the minimum requirement. 

On top of that, you’re expected to apply mitigating measures like pseudonymization to reduce the impact on individuals, and to keep the data subject's right to object available under Art. 21 GDPR. If people can’t realistically opt out, this basis doesn’t hold.

Contractual Necessity and Legal Obligation

Two of the remaining bases may come up, but they’re not as likely to be used to justify data processing for AI training.

Contractual Necessity

This only covers processing that is necessary to deliver a specific service someone signed up for. The processing has to be genuinely required to perform the contract. Training a general model on customer data is almost never needed to deliver the service the customer paid for, so contract does not stretch to cover it.

Legal Obligation

This applies where a law requires you to process the data, such as tax or anti-money laundering rules. It is narrow by design, and commercial AI training is almost never something the law mandates, so this basis rarely applies.

GDPR Compliance Checklist for AI Training Data

Now that you know how the GDPR applies to AI training data, you can start identifying compliance gaps in your organization. Use this list to audit your current AI data practices. Anything you can’t check off is a good place to focus first.

How Cookiebot™ Helps You Build a Foundation for GDPR-Compliant AI Use

Most of the requirements in this guide begin at the point of collection. When the data feeding an AI workflow comes from your website and customers, you need a consent management platform (CMP) like Cookiebot™. 

Cookiebot™ handles the consent layer for the cookies and trackers on your site, not the training data itself, so think of it as the first step that puts website-collected data on a lawful footing.

The tool scans your site and shows a consent banner that blocks non-essential cookies and trackers until a visitor makes a choice. 

Each choice is recorded with a timestamp and what the visitor agreed to, so the consent behind your data has a clear, documented starting point. Cookiebot™ CMP keeps audit-ready consent logs you can export, which gives you the documentation regulators require without having to reconstruct it after the fact.

Getting the first consent collection step right is what supports everything downstream, from AI training to deployment.