data protection
Data protection is the collection of rules and practices that define who can use your personal data, for what purpose, and for how long.
In plain terms
Imagine handing your house key to a neighbor to water the plants. That does not let them look into your drawers or copy the key, and they must give it back when you get home. Data protection says the same about your data: whoever receives it may use it only for the purpose for which it was given.
Personal data is any information concerning you that allows you to be identified directly or by combining it with other data: your name, phone number, address, voice, face, but also what you searched for online. Data protection does not ban the use of this data but conditions it: a legitimate reason, clear purpose, and notification are required.
In the age of artificial intelligence, this has become important again because AI systems learn from vast amounts of data, and what you type into a chatbot is also data. If an AI agent accesses your email or calendar, it also gains access to the data of your correspondents and acquaintances, who know nothing about it.
How it works
- A legal basis is required: a company or authority may process your data only if one of the reasons listed in the law applies, such as your consent, performance of a contract, a legal obligation, or the data controller's legitimate interests after balancing.
- Purpose limitation and data minimization: they may only request as much data as is necessary for the specified purpose and retain it only as long as needed.
- Information: they must explain in understandable terms what they collect, why, to whom they pass it on, and how long they store it.
- You have rights: you can request the data stored about you, ask for corrections or deletion, and object to certain uses.
- Oversight and sanctions: if rules are violated, you can file a complaint with the authority (in Hungary, this is the NAIH), which can impose fines, or you can turn to the courts.
An everyday example
You paste a client's complaint letter into a free chatbot to help draft a polite reply. The letter contains their name, address, and a sentence referring to their health condition. Health data is additionally classified as particularly sensitive personal data. Thus, you have transferred their personal data to an external company without their knowledge, which, depending on the service terms, could even use it to train its models. This is a data protection issue even if done with good intentions.
Who is affected
A common misconception
Limits and risks
- The law alone does not protect you: what you once released or published publicly is difficult to retrieve in practice.
- It is very difficult to remove specific personal data from an already trained AI model, so the right to erasure can only be enforced to a limited extent.
- Data protection notices are often long and hard to understand, so many people accept them without reading.
- Rules vary by country. The GDPR applies to service providers outside the EU if they offer services to people living in the EU, but enforcing your rights against them is more difficult in practice.
Similar, but not the same
- data security – Data security is the technical and organizational protection (passwords, encryption, backups) against theft and damage. Data protection regulates what the data may be used for at all, and appropriate security is only one requirement of this.
- privacy protection – Privacy protection means respecting private life, the home, and communication. Data protection largely overlaps with this, but in the EU it is an independent fundamental right and covers all personal data, including non-secret, public data.
- confidentiality – Confidentiality is an obligation of a specific person or profession (such as a doctor or lawyer), whereas data protection applies to everyone handling personal data.
Related concepts
AI regulation, digital rights
personal data, consent, right to erasure, data protection impact assessment, data protection by design
privacy protection, GDPR, data security, EU AI-rendelet, anonymization, training data
A brief history
The world's first data protection law was adopted by the German state of Hesse in 1970. The Council of Europe codified the principles in an international convention in 1981. The EU's General Data Protection Regulation (GDPR) was adopted in 2016 and has been applicable since May 25, 2018.
Where things stand
In the EU, the GDPR has been a mandatory baseline since 2018, and authorities also apply it to AI providers. At the end of 2026, two main debates are under way. One concerns how the rules can be enforced in the training of large language models and with autonomous agents. The other concerns how far the European Commission's simplification proposal submitted at the end of 2025, the so-called digital omnibus, should relax the rules.
In the news
- Hamburg data protection authority drafts letters with an OpenAI model as complaints rise 62%Nov 8, 2026 · Jog
- Hungarian professional publications: shadow AI, deepfakes and data protection risks at companiesNov 3, 2026 · Jog
- UK regulators say existing laws apply to AI agentsNov 2, 2026 · Jog
- Hungarian article warns of GDPR risk when property managers upload condominium documents to AI toolsOct 27, 2026 · Jog
- Idaho attorney general demands data protections for users of bankrupt chatbot companyOct 26, 2026 · Jog
- WhatsApp help pages told company's AI not to mention data protection authoritiesOct 20, 2026 · Jog
- Andhra Pradesh makes AI training compulsory for 80,000 state school teachers by month-endOct 19, 2026 · Education & Family
- Medicare official says parts of AI-assisted WISeR prior authorization pilot in six states are not workingOct 19, 2026 · Health
Also known as
data protection · protection of personal data · data protection · data privacy · information privacy · data protection regulation
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.