What is GDPR?
The General Data Protection Regulation (GDPR) is the European Union's law governing how the personal data of people in the EU is collected, used, stored and shared.
In more detail
It reaches organizations anywhere that offer goods or services to people in the EU or monitor their behavior, so a US business with EU customers can be in scope. Core ideas: a lawful basis for each use, purpose limitation, data minimization, security, rights for individuals (access, correction, erasure), breach notification and records of processing. Fines come in two tiers: up to 10 million euros or 2 percent of worldwide annual turnover, and up to 20 million euros or 4 percent for the more serious breaches, whichever is higher. For AI projects it raises practical questions: where prompts are processed, whether providers keep data and whether automated decisions need human review. Get legal advice for your situation.
Example
An HR automation that screens CVs processes personal data. The team documents the lawful basis, tells candidates how their data is used, keeps CVs for a stated period and names a recruiter who is accountable for each decision.