GDPR

The General Data Protection Regulation is the EU's data privacy law (in force since 2018) that governs how personal data of EU residents must be collected, stored, processed, and deleted — with major fines for noncompliance.

GDPR matters for AI in three places: the lawful basis for processing personal data through a model, the right to explanation for automated decisions affecting people, and the right to erasure (which is hard when training data is baked into model weights). Production AI systems handling EU data need DPAs with model providers, in-region processing where possible, and PII redaction at minimum.

Example

An EU resident requests their data be deleted. The AI vendor must remove their data from logs, vector stores, and training corpora — and document that it's gone.

How OpenLabor uses it

OpenLabor offers a GDPR-compliant configuration: EU residency, DPA, PII redaction, and right-to-erasure tooling.

Can I send EU customer data to OpenAI or Anthropic?

With a signed DPA, region-pinned endpoints, and zero-retention configurations — yes. Without those, no.

Related: data-residency, pii-redaction, audit-trail, eu-ai-act.

AI Labor Glossary