Is AI GDPR-compliant in Germany and the EU?

The short answer is: not by default. Under the GDPR, the key question is not whether a system is called “AI”. It is whether a specific AI model or AI-enabled service processes personal data — during development, deployment or use — and whether that processing has a valid GDPR basis and a defensible assessment behind it .

That also means the opposite slogan is wrong. AI is not automatically unlawful in Germany or the wider EU. The European Data Protection Board (EDPB), the EU body that brings together national data protection authorities, has not issued a blanket ban or a blanket green light. Its Opinion 28/2024 focuses on “certain data protection aspects” of processing personal data in the context of AI models .

The quick verdict

The claim “AI is GDPR-compliant” is too broad to be useful. So is the claim “AI always breaches the GDPR.” The GDPR assessment has to be tied to a concrete processing operation: what personal data is involved, for what purpose, on what legal basis, and with what implications for later use .

In its 18 December 2024 announcement, the EDPB said Opinion 28/2024 looks at three central issues: when and how AI models can be considered anonymous, whether and how legitimate interest can be used as a legal basis for developing or using AI models, and what happens if an AI model was developed using personal data that was processed unlawfully .

For a German company, public body or service provider, that leads to the same practical answer as elsewhere in the EU: do not assess “AI” in the abstract. Assess the actual data processing around the model.

What EDPB Opinion 28/2024 actually covers

Opinion 28/2024 is important because it addresses AI models through the lens of personal data processing . It does not settle every legal issue around artificial intelligence. It focuses on several GDPR questions that are especially important in AI projects: anonymity, legitimate interest, and the legal consequences of problematic data processing during development .

That framing matters. A model’s technical label, size or novelty does not decide compliance. The relevant question is whether personal data is processed in the model’s development or use, and whether the GDPR requirements can be met in that specific setting .

1. An AI model is not automatically anonymous

A common mistake is to assume that once personal data has been absorbed into a model, the model must be anonymous. The EDPB’s announcement says the opposite kind of shortcut is not enough: whether an AI model is anonymous should be assessed case by case by data protection authorities .

In practice, that means a controller cannot rely on a bare statement that “the model is anonymous”. The assessment has to be credible for the actual model and the actual circumstances .

This becomes especially important if personal data is retained in the model. ENISA-hosted material on the EDPB opinion describes scenarios in which retained personal data may affect the lawfulness of later processing, with a case-by-case assessment required .

2. Legitimate interest may be possible — but it is not a magic pass

The EDPB opinion expressly considers whether and how legitimate interest can be used as a legal basis for developing or using AI models . That is significant, but it does not mean legitimate interest automatically covers every AI project.

The question is whether that legal basis works for the specific processing operation. The available EDPB materials do not create a general “AI exception” to the GDPR .

The assessment can become more complicated if earlier data processing was unlawful. The ENISA material notes that where later processing is based on legitimate interest, initial unlawfulness may need to be considered in the legitimate interest assessment .

3. A model’s training history can still matter

Another core issue in Opinion 28/2024 is what happens when an AI model has been developed using personal data that was processed unlawfully .

The practical point is simple: a problematic data origin does not necessarily disappear just because the original dataset is no longer the focus and the model is now being used. If personal data is retained in the model, that may affect the lawfulness of later processing, and ENISA’s material again points to the need for a case-by-case assessment .

Responsibilities also matter when more than one organisation is involved. The ENISA material distinguishes between scenarios involving the same controller and separate controllers, and states that each controller should ensure the lawfulness of its own processing . In plain terms, an organisation cannot assume another party’s role removes its own GDPR obligations.

A practical GDPR checklist for AI projects

This checklist is not legal advice, but it reflects the main points raised by the EDPB and ENISA materials cited here.

1. Define the phase and purpose

Be clear about whether the processing relates to development, deployment or another use of the AI model. The EDPB’s announcement refers specifically to personal data used for the development and deployment of AI models .

2. Identify where personal data is processed

Document whether personal data is processed at any point in the AI lifecycle. Opinion 28/2024 is about data protection aspects related to processing personal data in the context of AI models .

3. Prove anonymity rather than asserting it

If the organisation claims the model is anonymous, that conclusion needs to stand up in the specific circumstances. The EDPB says model anonymity should be assessed case by case .

4. Match the legal basis to the actual processing

If legitimate interest is being used, assess whether and how it supports the specific development or use of the model . The cited materials do not support a blanket rule that all AI processing is covered by legitimate interest .

5. Review the model’s content and data history

Check whether personal data may remain in the model and whether the data used during development was processed lawfully. Both issues can affect later processing .

6. Allocate controller responsibilities

Where several organisations are involved in building, providing or using a model, clarify who is responsible for which processing step. ENISA’s material says each controller should ensure the lawfulness of its own processing .

Common myths about AI and the GDPR

“The model is anonymous because users cannot see the raw training data.” Not necessarily. The EDPB says anonymity of an AI model should be assessed case by case .

“Legitimate interest always works for AI.” No. The EDPB opinion examines whether and how legitimate interest can be used; it does not turn legitimate interest into an automatic justification for every AI use .

“Once the model is trained, the origin of the data no longer matters.” That is too simple. The opinion expressly addresses what happens if a model was developed using unlawfully processed personal data . If personal data remains in the model, later processing may be affected .

Bottom line

AI can be used in a GDPR-compliant way in Germany and the EU, but it is not compliant just because it is AI. Nor is it automatically prohibited. The serious GDPR question is the concrete processing of personal data — especially anonymity, legal basis, retained model data, controller responsibility and the possible consequences of unlawful earlier processing .