Skip to main content
Praxikon

Guideline

Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

Date
Status
final
Body
European Data Protection Board (EDPB)
Reference
Opinion 28/2024 (artikel 64 lid 2 AVG)

What it is about

At the request of the Irish supervisory authority the EDPB answers three questions: when an AI model is anonymous, whether legitimate interest can be a legal basis for developing and using AI models, and what the consequences are when a model was developed with unlawfully processed personal data. Anonymity must be assessed case by case; the likelihood of extracting personal data from the model or obtaining it through queries must be insignificant. On legitimate interest the opinion builds on Guidelines 1/2024 and recalls the three step test. The opinion was adopted on 17 December 2024 and published on 18 December 2024.

What this means in practice

If you develop or buy an AI model you must be able to show documentation about the training data, the legal basis and the measures against extraction of personal data. Relying on legitimate interest requires a documented balancing test for both training and deployment. When buying a third party model you must carry out an appropriate assessment of whether it was lawfully developed.

The GDPR articles concerned

Source: EDPB opinion pagechecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 15

Guidelines8 of 12

Enforcement and fines8 of 11

Legislation in motion6 of 10