GDPR and AI processing of personal data

AI processing of personal data needs an appropriate legal basis; health and other special-category data require an additional applicable condition. Article 22 addresses solely automated decisions with legal or similarly significant effects, subject to exceptions and safeguards. A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to individuals. Next key date: none recorded. Last verified October 29, 2026.