Regulation/regulations/gdpr

AI incidents and GDPR

Official text: Regulation (EU) 2016/679 on EUR-Lex ↗

The General Data Protection Regulation (EU) 2016/679 governs the processing of personal data of people in the European Union and European Economic Area. It has applied since 25 May 2018 and is enforced by national data protection authorities.

For AI systems, the provisions most often cited include lawful basis for processing (Article 6), transparency (Articles 12 to 14), automated decision-making (Article 22) and data protection by design (Article 25).

Confirmed regulatory enforcement

Regulator or court finding

A regulator, court, or authority has issued a decision, order, or fine citing GDPR. Regulation-level filtering is not yet available, so this shows recent incidents across the full index instead.

Sep 2026The Recording Light on AI Smart Glasses Could Be Bypassed. That Made Everything Worse.OECD Sep 2026ZCode Uploaded Developer Code and Git History Without Asking AnyoneOECD Sep 2026Tasmania's Parole Board Cited AI-Invented Cases to Restrict a Prisoner's SpeechOECD Sep 2026Ten Million Articles Without a License: The Times Takes AI Training to CourtOECD Sep 2026The Second Lawsuit Against Suno Is About 60,000 Songs Nobody LicensedOECD

Potential relevance

Relevant regulatory context

The incident may involve a GDPR regulated context, but no authority has made a finding. Inclusion does not indicate a determination of legal relevance.

Regulation-level filtering will be available once the dataset includes regulation tags.