What is the GDPR compliance checklist for AI systems in 2026?

AI systems processing EU personal data must comply with: (1) documented lawful basis under Article 6, (2) Article 22 automated decision-making restrictions including human review mechanisms, (3) mandatory DPIA before deployment, (4) Article 9 controls for special category data, (5) valid 2021 Standard Contractual Clauses for any US-based AI vendors, and (6) Article 28 processor agreements with all AI service providers.

Does GDPR apply to AI systems outside the EU?

Yes. GDPR applies to any processing of EU residents' personal data, regardless of where the processing organisation is located. A US-based AI company with EU users has full GDPR obligations under Article 3's extraterritorial scope.

What is the maximum GDPR fine in 2026?

The maximum fine under GDPR is €20 million or 4% of global annual turnover - whichever is higher. This cap applies separately per violation. The largest single fine to date is Meta's €1.2B penalty issued in 2023 for unlawful data transfers.

What does Article 22 GDPR require for AI decisions?

Article 22 prohibits fully automated decisions that produce legal or similarly significant effects on individuals without human oversight. Organisations must provide a mechanism for data subjects to request human review, express their point of view, and contest the decision. This applies to AI used in credit scoring, insurance, hiring, and content moderation.

What is the difference between GDPR and CCPA compliance?

GDPR is a comprehensive rights-based framework requiring a lawful basis for every processing activity, mandatory DPIAs, and strict cross-border transfer controls. CCPA is narrower - a California consumer privacy law focused on opt-out rights for data sales and disclosure obligations. GDPR generally has stricter requirements and higher penalties.

GDPR Compliance Checklist 2026: The Complete Guide for AI…

What GDPR actually requires - mapped to machine-executable logic, not PDF checklists.

Why GDPR Compliance Is Rising Again in 2026

Search interest in GDPR compliance is up 30% year-on-year in 2026, and for good reason. Three enforcement trends are driving renewed urgency: (1) the European Data Protection Board has issued new guidelines on AI-generated profiling, (2) DPA fines for cross-border data transfers have reached €1.2B in cumulative 2025-2026 penalties, and (3) the EU AI Act's interaction with GDPR has created a dual-compliance requirement for any AI system that processes personal data. If your organisation deploys AI models that touch EU personal data - even for users outside the EU - you have GDPR obligations. This checklist addresses the twelve requirements most frequently cited in enforcement actions.

The GDPR Compliance Checklist: 12 Critical Requirements

1. Lawful Basis for Every Processing Activity

Under Article 6, every processing activity must have a documented lawful basis before data collection begins. Consent, legitimate interests, and contractual necessity are the three most common. Each basis has a different threshold and a different set of obligations downstream. Legitimate interests requires a three-part balancing test (purpose, necessity, balance) - most organisations have not documented this properly.

2. Article 13 and 14 Privacy Notices

Your privacy notice must include the categories of data collected, the lawful basis, the retention period, and the identity of any third-party processors. Notices written before 2021 are likely non-compliant: the EU's revised Standard Contractual Clauses (SCCs) require explicit disclosure of cross-border transfer mechanisms.

3. Article 22 - Automated Decision-Making Restrictions

Article 22 is the highest-risk provision for AI systems. If your AI makes a decision that "produces legal effects or similarly significantly affects" a data subject - credit scoring, insurance underwriting, recruitment filtering, content moderation - the data subject has the right to not be subject to that decision and to request human review. Most AI deployments have not implemented this override mechanism. This is now a primary enforcement target.

4. DPIA Requirement for High-Risk Processing

A Data Protection Impact Assessment is mandatory before deploying any AI system that involves systematic profiling, large-scale processing of special category data, or automated decision-making. The DPIA must describe the processing, assess necessity and proportionality, and identify mitigating controls. Deploying without a DPIA is a standalone violation regardless of outcome.

5. Article 9 - Special Category Data Controls

Health data, biometric data, race, religion, political opinion, and sexual orientation require explicit consent or another narrow exception under Article 9. Using a general-purpose LLM to process healthcare records or HR data without Article 9-compliant controls is a critical failure. The maximum fine for this category is €20M or 4% of global annual turnover.

6. Standard Contractual Clauses for Cross-Border Transfers

Since Schrems II invalidated Privacy Shield in 2020, all EU-to-third-country data transfers require a valid transfer mechanism. The 2021 revised SCCs are now the operative standard. If your AI vendor is US-based, you must have valid 2021 SCCs in place. Legacy 2010 SCCs are legally invalid for new processing activities.

7. Processor Agreements (Article 28)

Every third-party that processes personal data on your behalf - including AI model providers, cloud hosts, and analytics platforms - requires a written processor agreement containing specific GDPR-mandated clauses. An API call to an AI service without an Article 28 agreement is a compliance gap.

8. Breach Notification (72-Hour Rule)

Article 33 requires notification to your supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals. Article 34 requires direct notification to affected individuals for high-risk breaches. Most organisations have a breach process; far fewer have tested it against the 72-hour clock.

9. Right of Erasure (Article 17)

Data subjects can request erasure when data is no longer necessary, consent is withdrawn, or processing was unlawful. For AI systems trained on user data, this creates a specific obligation: you must be able to demonstrate that an individual's data has been excluded from training or inference pipelines, or retrain the model if erasure is technically required. "We can't retrain the model" is not an accepted response under GDPR.

10. Data Minimisation and Storage Limitation

Articles 5(1)(c) and 5(1)(e) require that you collect only data necessary for the stated purpose and delete it when that purpose is complete. AI systems that retain user interaction logs indefinitely for "model improvement" without a specific documented basis and retention schedule are in breach of these principles.

11. Records of Processing Activities (Article 30)

Organisations with 250+ employees (or any organisation conducting high-risk processing) must maintain a Record of Processing Activities (ROPA). For AI deployments, each model pipeline, training dataset, and inference endpoint is a distinct processing activity requiring its own ROPA entry.

12. Data Protection Officer (DPO) Appointment

A DPO is mandatory for public authorities, organisations that systematically monitor individuals at scale, or organisations processing special category data at scale. The DPO must have expert knowledge of data protection law and must report directly to the highest level of management - not to the Legal or IT function.

GDPR and the EU AI Act: Dual Compliance Requirements

From August 2026, high-risk AI systems under the EU AI Act (Annex III use cases) must comply with both the AI Act's technical documentation and conformity requirements AND GDPR's data processing obligations. The two frameworks do not duplicate each other - they layer. An AI system used in hiring that processes CVs is subject to EU AI Act Annex III requirements (human oversight, accuracy, logging) and GDPR Article 22 automated-decision restrictions simultaneously. Your compliance programme must address both.

How Bidda Verifies GDPR Compliance Logic

Bidda's 39 GDPR nodes decompose each article, recital, and EDPB guideline into machine-executable deterministic logic. Each node cites the specific Article, paragraph, and binding EDPB guidance - no paraphrasing. Compliance agents can query the Article 22 node to retrieve the exact threshold at which automated decision-making restrictions apply, the human review override obligation, and the documentation requirements - and execute the verification workflow programmatically.

GDPR Compliance Checklist 2026: The Complete Guide for AI and Data Systems