GDPR
in English: General Data Protection Regulation
The European Union's data protection regulation, which specifies who can use your personal data, for what purpose, and for how long, and what rights you have in this regard.
In plain terms
The GDPR is the European Union's common data protection rulebook. It states that data about you – your name, address, purchases, health status, voice or face – is not fair game for companies. Anyone who wants to use it needs a reason and a purpose, and bears responsibility.
Imagine it like your house key. You can give it to your neighbor to water the flowers, but that does not mean they can move in, copy the key, or refuse to return it when you ask. The GDPR prescribes the same for your data: it can only be used for what you gave it for, and only as long as necessary.
In the age of artificial intelligence, this is especially important. AI systems learn from vast amounts of data, and an AI agent can read emails on your behalf, handle customer data, or prepare decisions. The GDPR applies to these as well: it does not matter whether a human or a machine touches the data; the rules are the same.
It is different from the EU AI Act: the AI Act regulates the risks of the technology, while the GDPR protects your data, regardless of the tool used to process it.
How it works
- A legal basis is required: data can only be processed for a permitted reason – for example, based on your consent, a contract with you, a legal obligation, or the company's legitimate interests.
- Goal and scope: you must state in advance what the data is for, only the necessary amount can be requested, and it cannot be stored indefinitely.
- You have rights: you can ask what they know about you, request correction, deletion, or a copy of your data, and object to its use.
- Automated decisions: as a general rule, an automated system alone cannot make a decision with serious consequences about you (for example, in credit assessment). Where this is exceptionally permitted, you can request human intervention, state your position, and challenge the decision.
- Supervision and fines: compliance is monitored by a national authority – in Hungary, the NAIH (National Authority for Data Protection and Freedom of Information). A data protection incident (such as a data breach) must generally be reported to the authority within 72 hours of becoming aware of it. The maximum fine is 20 million euros or 4 percent of annual global turnover – whichever is higher.
An everyday example
You open a website and a cookie banner pops up asking if you accept tracking – this is due to the GDPR and related EU regulations. For the same reason, you can write to an online store to delete your account and data, and for the same reason, a company must consider whether it can enter customer data into an AI chatbot.
Who is affected
A common misconception
Limits and risks
- The GDPR only protects personal data: it does not apply to truly anonymous data and companies' business data, nor to purely private data processing (such as your own phone book).
- Your rights are not unlimited: for example, deletion can be refused if the law requires data retention (as with invoices).
- It is difficult to later "delete" someone's data from an already trained AI model, so the right to erasure is hard to enforce in practice.
- If you enter workplace or customer data into a public AI tool, you may be transferring data to an external company; check your workplace's policy beforehand.
Similar, but not the same
- EU MI-rendelet (AI Act) – The AI Act regulates AI systems according to their risk, while the GDPR governs the processing of personal data, whether AI is involved or not.
- Data security – Data security refers to technical protection (passwords, encryption), while the GDPR is broader: it also specifies whether data may be collected and used at all.
- Copyright – Copyright protects creations, while GDPR covers data about people – these are separate issues regarding AI training data.
Related concepts
Data protection, AI regulation, European Union law
Contribution, Right to Erasure, Automated decision-making, Data Protection Impact Assessment, data privacy incident
EU MI-rendelet (AI Act), Personal data, Anonymization, Profiling, Training data
A brief history
The European Union adopted the regulation in 2016, replacing the 1995 data protection directive. It has been applicable in all member states, including Hungary, since May 25, 2018.
Where things stand
The GDPR has been mandatory across the entire EU since 2018 and has served as a model for data protection laws in other countries worldwide. By the end of 2026, the main question is how it can be applied to the training of AI models and to independently working agents, while the EU debates simplifying the rules.
In the news
- Noyb files five GDPR complaints against Scale AI over worker surveillanceOct 27, 2026 · Jog
- Hungarian article warns of GDPR risk when property managers upload condominium documents to AI toolsOct 27, 2026 · Jog
- Noyb comments on EU Council agreement on AI personal data processing under GDPROct 26, 2026 · Jog
- UK GDPR still applies to AI after the Data (Use and Access) Act, NeuralTrust saysOct 22, 2026 · Jog
- Poland begins work on law to criminalise erotic deepfakesOct 21, 2026 · Jog
- EU backs GDPR change letting AI use personal data without consentOct 19, 2026 · Jog
- EDPB publishes €824.99 million GDPR fine against Uber; Noyb cites €2 billion in finesOct 12, 2026 · Jog
- AI Act and GDPR: what a Hungarian SME needs to knowOct 5, 2026 · Jog
Also known as
GDPR · General Data Protection Regulation · General Data Protection Regulation · (EU) 2016/679 rendelet · EU data protection regulation · EU data protection regulation · Regulation (EU) 2016/679 · European data protection regulation
Sources
- Wikipedia: General Data Protection Regulation
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.