Skip to content
AIGP Quest

AIGP cheat sheet · II.A · BoK v2.1

GDPR and privacy law for AI

II.A Privacy law meets AI (4 to 6 exam questions)

Understand how existing data privacy laws apply to AI.

II.A.1 · Lawful basis, notice and purpose for AI

  • Every AI phase that touches personal data needs a lawful basis; training and deployment are assessed separately.
  • Legitimate interests is the usual basis for training, but only after a purpose, necessity and balancing test, and it brings a right to object.
  • Reusing data for a new AI purpose requires a compatibility assessment first.
  • Transparency includes telling people about AI use and giving meaningful information about the logic of significant automated decisions.
  • US law leans on notice and opt-outs, with the FTC policing misleading or retroactive changes to terms.
Lawful basis:
One of the six GDPR grounds (consent, contract, legal obligation, vital interests, public task, legitimate interests) that must apply before personal data is processed.
Legitimate interests assessment (LIA):
A documented three-step test of purpose, necessity and balancing that a controller runs before relying on legitimate interests.
Purpose limitation:
The principle that personal data collected for specified purposes must not be reused in ways incompatible with them.
Compatibility assessment:
The Article 6(4) analysis of link, context, nature of data, consequences and safeguards used to decide whether a new purpose fits the original one.
Right to object:
The GDPR right (Article 21) to object to processing based on legitimate interests or public task, which the controller must honor unless it has compelling overriding grounds.

Exam tips: 'The data was already public' or 'we already hold it' never ends the analysis. Pick the option that checks lawful basis and purpose compatibility first. · Employee consent is a red flag because of the power imbalance; look for another basis plus safeguards. · Training and deployment are separate processing activities. An option that lets one lawful basis cover both is usually wrong. · Match the jurisdiction: EU means a lawful basis before processing; US means notice plus opt-out rights, with the FTC policing misleading practices.

II.A.2 · Data minimization and privacy by design

  • Minimization means adequate, relevant and necessary for the purpose: a balance, not a blind cut.
  • Storage limitation: identifiable data goes when the purpose is done.
  • GDPR Article 25 codifies privacy by design and by default, building on Cavoukian's seven principles.
  • Privacy-enhancing techniques reduce risk, but only real anonymization takes data out of scope.
  • Models can memorize, so minimization continues after training.
Data minimization:
Processing only personal data that is adequate, relevant and limited to what is necessary for the stated purpose.
Storage limitation:
Keeping personal data in identifiable form no longer than the purpose requires.
Privacy by Design (PbD):
Ann Cavoukian's framework of seven principles for building privacy into systems proactively and by default.
Data protection by design and by default:
GDPR Article 25's duty to build in measures that make the principles effective, and to process only what each purpose needs by default.
Pseudonymization:
Replacing identifiers with codes kept separately; the data stays personal data for anyone who can re-link it.
Memorization:
A model's tendency to retain and reproduce parts of its training data, which can expose personal data.

Exam tips: Any option that minimizes data 'regardless of the model's effectiveness' is a trap. The IAPP answer balances privacy and utility. · Encryption is security, not minimization. Don't let a security control answer a minimization question. · Privacy by design is proactive: if an option fixes privacy after launch or after a complaint, it's wrong. · Pseudonymized data is still personal data; only true anonymization takes data outside the GDPR.

II.A.3 · Controller duties I: DPIAs, vendors, transfers

  • The controller decides why and how, and stays accountable when vendors do the work.
  • DPIAs are required for likely high-risk processing, including profiling with significant effects; many AI projects qualify.
  • Article 28 contracts bind processors to instructions, security, sub-processor approval, assistance and deletion.
  • EU transfers need adequacy (such as the DPF), SCCs or binding corporate rules with a transfer impact assessment, or a narrow derogation.
  • Accountability means records: an Article 30 ROPA in the EU, documented assessments under US state laws.
Controller:
The party that decides the purposes and essential means of processing personal data, and carries primary accountability.
Processor:
A party that processes personal data on a controller's behalf and documented instructions.
Data protection impact assessment (DPIA):
A GDPR-mandated assessment, done before processing, of high-risk processing's necessity, risks and mitigations.
Standard contractual clauses (SCCs):
European Commission-approved contract terms used as a safeguard for transferring personal data out of the EU.
Transfer impact assessment:
An analysis of whether the destination country's laws undermine the protection a transfer mechanism promises.
Record of processing activities (ROPA):
The Article 30 register of an organization's processing purposes, data, recipients, transfers, retention and security.

Exam tips: Roles follow conduct, not contract labels: a 'processor' that trains its own model on your data is a controller for that processing. · A FIRST question involving a border usually wants the transfer mechanism settled before any data moves. · DPIA means before processing. An option that assesses risk after deployment is a trap. · The IAPP favors extending an existing PIA or DPIA into an AI impact assessment over building one from scratch.

II.A.4 · Controller duties II: rights, ADM, breaches

  • Access, rectification, erasure, restriction, objection and portability all reach AI data, including inferences.
  • Article 22 restricts solely automated, significant decisions: allowed only for contract, by law or with explicit consent, plus safeguards.
  • Explanations must cover the procedure and principles actually applied, not a raw formula.
  • US states offer profiling opt-outs; California's ADMT rules add notice, opt-out and access rights.
  • Breaches: tell the regulator within 72 hours if there's risk, tell individuals if the risk is high, and document everything.
Right of access:
The right to obtain one's personal data and information about its processing, including meaningful information about the logic of automated decisions.
Article 22:
The GDPR right not to be subject to solely automated decisions with legal or similarly significant effects, subject to three exceptions and safeguards.
Meaningful human involvement:
Review by a person with the authority, competence and information to change an automated outcome, as opposed to rubber-stamping.
Personal data breach:
A security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
Automated decisionmaking technology (ADMT):
California's term for technology that replaces or substantially replaces human decision-making, regulated under its 2026 privacy rules.

Exam tips: Article 22 needs BOTH 'solely automated' AND a legal or similarly significant effect. A rubber-stamp human doesn't break the 'solely' chain. · The three Article 22 exceptions are contract, law and explicit consent. Legitimate interests and ordinary consent are distractors. · Article 22 safeguards are human intervention, expressing a view and contesting the decision: not access to source code, and not automatic reversal. · The 72 hours is for notifying the supervisory authority; individuals are told 'without undue delay' and only when the risk is high.

II.A.5 · Sensitive data and biometrics

  • Article 9 prohibits processing special categories unless an exception, such as explicit consent, applies, on top of an Article 6 basis.
  • Biometrics become special category when processed to uniquely identify someone; photos alone don't.
  • US protection comes from state biometric laws (BIPA, CUBI), sensitive-data opt-ins and FTC enforcement.
  • Inferences can create sensitive data, and bias testing needs a lawful, safeguarded route.
Special categories of personal data:
GDPR Article 9 data (ethnic origin, political opinions, beliefs, union membership, genetic, biometric for identification, health, sex life or orientation) whose processing is prohibited unless an exception applies.
Biometric data:
Personal data from technical processing of physical, physiological or behavioral traits that allows or confirms a person's unique identification.
Explicit consent:
A clear, express statement of consent (for example, a signed or separately confirmed statement), required for some Article 9 and Article 22 exceptions.
BIPA:
Illinois' Biometric Information Privacy Act, requiring written notice and release before collecting biometrics and allowing private lawsuits.
Sensitive data (US state laws):
Categories such as biometrics, health, precise location and children's data that state privacy laws usually allow only with opt-in consent.

Exam tips: 'It was already public' is never a defense for biometrics or other sensitive data. · Biometrics are GDPR special category when used to uniquely identify someone; templates and hashes still count. · BIPA means a written release plus a private right of action. A US question about class actions over faceprints points to Illinois. · Inferred sensitive traits are still sensitive. An AI that guesses health or orientation is processing special category data.

Independent study aid, not affiliated with the IAPP. Written with AI from primary sources; laws change, so check the sources. Last updated 7 Nov 2026.