Home › AI law, copyright and safety › GDPR and AI

GDPR and AI: what the EDPB's Opinion 28/2024 says

The EU's data protection board has set out how GDPR applies to AI models. Its Opinion 28/2024 answers three questions: when a model counts as anonymous, whether legitimate interest can justify training, and what follows if the training data was unlawfully processed. This page summarises it from the EDPB's own announcement. It is a plain-language summary, not legal advice. Section hub: AI law, copyright and safety; the binding AI statute is explained in the EU AI Act explained.

Quick answerThe EDPB's Opinion 28/2024 (adopted 18 December 2024) says an AI model is anonymous only if it is very unlikely to identify the people in its training data or to reveal their data through queries, assessed case by case. Legitimate interest can be a legal basis in some cases if strictly necessary, and unlawfully processed training data can affect later deployment.

By the Chelure Enterprises Editorial Team. Last reviewed 13 November 2026. How we check our sources.

The opinion at a glance

Question	EDPB answer (opinion adopted 18 December 2024)
When is an AI model anonymous?	Case by case, assessed by data protection authorities. The model must be very unlikely to identify the individuals whose data was used to create it, and very unlikely to allow that personal data to be extracted through queries
Can legitimate interest be a legal basis?	Yes in some cases, using a three-step test. Examples that can rely on it include a conversational agent that assists users and AI that improves cybersecurity, but only if the processing is strictly necessary and the balancing of rights is respected
What about unlawfully processed training data?	It could affect the lawfulness of deploying the model, unless the model has been duly anonymised

What the three answers mean

Anonymity is hard to claim. The test has two parts: identification of the people in the training data, and extraction of their data through queries. The EDPB gives a non-exhaustive list of methods to demonstrate anonymity, so developers should document testing against both. Legitimate interest needs justification. It is not automatic: the processing must be strictly necessary and the balance of rights respected, and the EDPB lists criteria for what individuals could reasonably expect, such as whether the data was publicly available and where it came from; mitigating measures can reduce negative impacts. Training history follows the model. Unlawful processing at the training stage can affect later deployment, unless the model is duly anonymised.

Practical checklist (our suggestions)

Record the sources and legal basis of training data.
Test whether personal data can be extracted from your model by queries.
Document the necessity and balancing assessment if you rely on legitimate interest.
If you deploy someone else's model, ask how it was trained.
Check the AI Act's separate duties: see the AI Act timeline.

We read the EDPB's announcement of the opinion, not the full 700 KB opinion document, so details such as the exact steps of the legitimate-interest test are not reproduced here.

Frequently asked questions

Does GDPR apply to AI models?

The European Data Protection Board's Opinion 28/2024, adopted on 18 December 2024, addresses when and how GDPR principles apply to AI models that are trained on or process personal data. It responds to a request from the Irish data protection authority for Europe-wide harmonisation.

When is an AI model anonymous?

The EDPB says anonymity must be assessed case by case by data protection authorities. A model should be anonymous only if it is very unlikely to identify the individuals whose data was used to create it and very unlikely to extract that personal data through queries.

Can legitimate interest be the legal basis for training?

The EDPB says it can be, in some cases, if the processing is strictly necessary and the balancing of rights is respected. It gives examples including a conversational agent that assists users and AI used to improve cybersecurity, and lists criteria for whether individuals could reasonably expect a use of their data.

What if the training data was processed unlawfully?

The EDPB says that if a model was developed using unlawfully processed personal data, this could affect the lawfulness of deploying it, unless the model has been duly anonymised.

Is the opinion a law?

It is an Opinion of the Board adopted under Article 64 of the GDPR. The EDPB describes it as providing elements for a case-by-case analysis rather than fixed rules, and says it is developing further guidelines, for example on web scraping.

Sources

Primary sources opened on November 13, 2026. Prices come from our verified price table (see the methodology).