Personal Data in AI Systems (GDPR)

Personal Data in AI Systems (GDPR) in practice

A chatbot on your website and software that sorts CVs both handle personal data. The GDPR therefore applies to you even if you simply bought the AI tool from a vendor. You need to know your legal basis for the processing, what you tell the people concerned, and whether a machine is making decisions about them with no human involved. Data that looks anonymous can still be personal data if individuals can be re-identified.

We start by mapping where data enters the system and where it goes. We then establish the legal basis under Article 6 GDPR, draft the privacy notices and, where the risk is high, prepare a data protection impact assessment (DPIA). If the EU AI Act also applies, we align both assessments so the same work is not done twice. In an inspection or complaint, we represent you before the Slovak Data Protection Authority.

What we help with

Audit of personal data flows in an AI system
Legal basis under Article 6 GDPR, including the legitimate interest test
Data protection impact assessment (DPIA) under Article 35 GDPR
Privacy notices under Articles 13 and 14 GDPR for chatbots and automated decisions
Internal AI use policy and vendor checks
Representation before the Slovak Data Protection Authority

Worth knowing

Decisions without a human

Article 22 GDPR gives people the right not to be subject to a decision based solely on automated processing where it has legal effects or similarly significant effects. Typical examples are automatic loan refusals or screening candidates before any interview. If a person with genuine authority to decide otherwise makes the final call, Article 22 usually does not apply.

DPIA for high-risk processing

Article 35 GDPR requires an impact assessment where processing is likely to result in a high risk to people's rights. With AI this is common, for example with profiling, biometrics or health data. The DPIA is updated when the system, the training data or the purpose changes.

Public data is not free to use

Data being publicly available does not mean you may train a model on it. Data collected from the internet still needs a legal basis and information for the people concerned under Article 14 GDPR.

Common questions

Not to the operation itself. The GDPR applies as soon as the AI processes, generates or transforms personal data. Seemingly anonymous data is personal data if there is a reasonable likelihood of re-identification (Article 4(1) GDPR).
When a decision is based solely on automated processing, including profiling, and has legal or similarly significant effects on the person. Automatic credit scoring is an example. If the AI only makes recommendations and a qualified person with real authority decides, Article 22 usually does not apply.
They apply side by side. The AI Act governs the AI system itself, such as risk classification, documentation and human oversight. The GDPR governs the personal data processed within it. A high-risk system under the AI Act will normally also need a DPIA under the GDPR.

Articles are in Slovak.

Discuss your matter with a lawyer

In a consultation we assess your situation, suggest a way forward and tell you what costs to expect.

€90 incl. VAT, 30 minutes, in person or online

This page is for general information, reflects Slovak law at the time of writing and is not a substitute for advice on your particular matter.

Personal Data in AI Systems (GDPR)