Before AI-specific law existed, the old laws were already watching. This module covers how current laws apply to AI systems, the six data-privacy principles, the global landscape (GDPR, CCPA/CPRA, BIPA), the ten DPA recommendations, and the GDPR × AI intersection.
The sheet's opening insight: AI adoption generally falls into two categories — and the law applies differently to each.
AI replaces or augments something the organisation already does — the legal obligations that applied to the old way carry over to the new way.
Example: a bank's loan decisions used to be made by loan officers; an AI now makes them. The same fair-lending and data-protection duties apply — the tool changed, the obligations didn't.AI enables something entirely new — and the law may have no direct precedent, so regulators map existing rules onto it.
Example: real-time emotion recognition in retail didn't exist as a regulated activity — regulators now apply biometric and transparency rules to it.The sheet's core list — six principles from data-privacy law that apply directly to AI systems, each with its plain-words meaning.
Information relating to the processing of personal data should be easily accessible, easy to understand, and in clear and plain language.
Example: the chatbot's privacy notice says "we use your chat history to train our AI" in one plain sentence — not a 40-page PDF.Individuals should be allowed to agree or disagree with the collection and use of their personal data in AI systems.
Example: a retailer offers an opt-out for AI-driven personalisation — customers can say no and still shop normally.AI systems should have a legal basis for processing personal data — e.g., consent, contract, legal obligation, vital interest, public interest, legitimate interest.
Example: a hospital processes patient data for an AI triage tool under the vital-interest and healthcare legal bases — not just "because AI is cool".AI systems should collect and use data only for the specified purpose.
Example: data collected for fraud detection cannot later be repurposed for marketing scoring without a new basis.Ensure data is adequate (not too little or too much), relevant, and limited to what is necessary for the intended purpose.
Example: a churn model needs subscription history — it does not need the customer's religion or ethnicity.AI systems should be designed, developed, and deployed with data protection and privacy principles applied from the beginning.
Example: the team runs a DPIA and builds in pseudonymisation before writing a line of model code — privacy is a design input, not a retrofit.The sheet's key observation: the global effort to apply existing laws to AI is progressing rapidly — likely at a higher rate than the creation of new AI-specific legislation.
| Law / regime | What it is | Why it matters for AI |
|---|---|---|
| GDPR | EU General Data Protection Regulation — the global baseline for personal-data protection | Applies to most consumer-facing AI in the EU: lawful basis, data subject rights, Art. 22 automated decisions, Art. 35 DPIAs |
| CCPA / CPRA | California Consumer Privacy Act + California Privacy Rights Act | US state privacy law with consumer rights (access, delete, opt-out) that apply to AI-driven profiling and data use |
| Other US state privacy laws | Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and more | A growing patchwork — each adds rights and obligations that AI systems must honour |
| Illinois BIPA | Biometric Information Privacy Act | Regulates collection and use of biometric identifiers — directly hits AI systems using face, voice, or fingerprint data |
Extracted from the guidance of different global data protection authorities — the sheet's numbered list 1–10. These are the exam's favourite "what should the provider do?" answers.
| # | Recommendation | Plain-words example |
|---|---|---|
| 1 | Integrate principles of privacy and data protection by default and by design at the planning and design stages of an AI project | The project kickoff includes a privacy-by-design review before any data is collected |
| 2 | Conduct PIAs and DPIAs prior to making AI tools available for public use | The chatbot's DPIA is signed off before the first user is onboarded |
| 3 | Process personal data only for specific, explicit, legitimate purposes; refrain from processing not in line with individuals' expectations | No "we'll figure out the use later" — every dataset has a stated purpose |
| 4 | Have a system in place for human oversight and verify review of AI input and output | A human reviews a sample of the model's decisions weekly, with escalation for anomalies |
| 5 | Provide transparent information on personal data collection and usage; providers should share information on privacy risks with deployers | The vendor's documentation tells the bank exactly what data the model uses and what risks remain |
| 6 | Have data governance and technical safeguards in place for review and filtering of personal data that is inaccurate or misleading | A data-quality pipeline flags and quarantines records with conflicting labels |
| 7 | Develop data retention and deletion plans for any personal information collected | Chat transcripts are auto-deleted after 90 days; the deletion job is tested quarterly |
| 8 | Implement cybersecurity controls and prevention techniques to keep attackers from extracting personal data from AI systems | Prompt-injection filters and rate limits stop attackers from pulling training data out of the chatbot |
| 9 | Maintain accurate technical documentation and demonstrate compliance with privacy and data protection laws and policies | The model card, DPIA, and data-flow map are kept current and audit-ready |
| 10 | Communicate closely with DPAs and privacy authorities | The team consults the PDPC early on a novel use case rather than after a complaint |
The sheet's challenge list — why applying traditional privacy law to AI is genuinely hard.
Addressing traditional privacy principles and practices — e.g., accuracy, notice, access, deletion — is difficult when the system's behaviour is emergent.
Example: "accuracy" of a generative model can't be checked record-by-record the way a database can.Legal requirements and applying data subject rights is complex for AI systems trained on datasets the system no longer holds or can access.
Example: a user asks to delete their data — but it's already baked into the model's weights; the organisation can't "delete" a gradient.Laws on issues like automated decision-making (GDPR) were designed with an awareness of AI's existence and potential impact — but not necessarily an in-depth understanding of it.
Example: GDPR Art. 22 was drafted in 2016 — it anticipated automated decisions but not foundation models or agentic systems.The sheet's GDPR block: baseline requirements, technology-agnostic design, the AI-programmes distinction, and the three key articles.
The GDPR sets the floor for using automated decision-making tools — Art. 22 and its safeguards.
Example: an AI-only loan rejection must offer human review because the GDPR says so.The GDPR's structure — rights, accountability, risk assessment — is the template most responsible-AI programmes follow.
Example: the bank's AI governance framework is built on GDPR's accountability model.AI systems use extensive amounts of data, frequently subject to GDPR requirements to collect, use, protect, and control data — including the right for individuals to delete their data.
Example: a recommendation engine's user profiles are personal data — access and deletion requests apply.Knowing how key articles apply to AI aids in understanding how to integrate privacy and data protection regulations into AI governance programmes.
Example: the AI governance playbook cites Art. 22, Art. 35, and Recital 26 as its privacy anchors.The GDPR is intended to be technology-agnostic, to adapt to evolving technologies over time — including AI.
Example: the GDPR's principles apply to a 2026 agentic system exactly as they did to a 2018 database.The GDPR is focused on the governing and processing of personal information — its scope is data, not technology.
Example: an AI that processes no personal data (pure aggregate statistics) falls outside GDPR scope.| GDPR | AI programmes | |
|---|---|---|
| Scope | Governing and processing of personal information | Process information that can include personal information — but does not necessarily include it |
| Focus | Data subject rights: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability | Model behaviour, performance, safety, and societal impact — broader than personal data |
| Exam tell | "Personal data", "data subject rights", "Art. 22" | "Model", "bias", "system behaviour" — may or may not involve personal data |
The right not to be subject to solely automated decisions with legal or similarly significant effects — with exceptions and required safeguards (meaningful human intervention, right to contest).
Example: an AI-only credit rejection triggers Art. 22 — the applicant can demand human review.Data Protection Impact Assessments, required in relation to high-risk or important processing — including AI that profiles or makes significant decisions.
Example: a hiring AI triggers a DPIA because it processes special-category data at scale.Techniques for pseudonymisation and anonymisation of data — the de-identification toolkit that can take AI data out of personal-data scope.
Example: a model trained on properly anonymised data falls outside GDPR personal-data scope (if anonymisation is robust).Tap a card to flip it. Term on the front, definition + exam tip on the back. If your browser doesn't support 3D flips, the cards still work — they cross-fade instead.
TRUE / FALSE — every question drawn directly from the Module 5 sheet. Instant feedback, best score persists.
Tap each item as you master it. The goal: fill every box from memory, not recognition.