GDPR for AI systems — where the Act meets data protection

The GDPR — Regulation (EU) 2016/679 — is statutory and, for any AI system that processes personal data, inseparable from the EU AI Act. Veritome does not try to be your whole data-protection function; it models where the two regimes meet so that one record serves both, and offers the organisation-wide work as a programme of its own. The per-system duties are not a switch: they are generated for every system that processes personal data. The organisation's duties are the GDPR programme under Frameworks → GDPR, switched on under Organisation → Frameworks when you want to run them here; free on every plan.

Per system: the data questions, seven duties

When you register a system you say whether personal data flows through it and, if it does, whether you decide why and how it is processed (controller), process it on a customer's instructions (processor) or decide jointly with another organisation (joint controller). Among the system's capabilities you then tick whether it processes special-category data, whether personal data leaves the EU/EEA, and whether it makes decisions about people with no human in the loop. The engine reads those answers and adds the GDPR rows that follow, beside the EU AI Act rows on the same system:

• Art. 6 lawful basis — for a controller or joint controller.
• Art. 9 special-category conditions — when the data includes them.
• Arts. 12–14 transparency and information to the data subject — for a controller or joint controller.
• Art. 22 automated individual decision-making — a controller or joint controller making solely automated decisions with legal or similarly significant effect.
• Art. 28 processor terms — whenever personal data is in play and you hold any data role; a processor owes this and the transfer rules, never a lawful basis, a notice or a DPIA of its own.
• Art. 35 data protection impact assessment — for a controller or joint controller whose system carries a DPIA trigger: solely automated decisions, special categories, AI used on workers, emotion recognition or biometric categorisation. Not a blanket: a controller with none of those triggers gets no DPIA row.
• Arts. 44–49 transfer safeguards — when data leaves the EU/EEA.

Those seven article groups are engine obligations, generated like any other and shown in their own GDPR lane inside the stage they belong to. They never count toward an EU AI Act gate or the journey figure: each system shows its GDPR duties as a second figure of its own (GDPR duties on this system, done of total), or No personal data. The rest of the GDPR — the principles, the individual rights, records of processing, security, breach notification, the DPO — is worked as the organisation's duties below.

The organisation's duties

Switch the GDPR programme on under Organisation → Frameworks and the GDPR's organisation duties are generated, listed on Obligations with Source GDPR and Scope Organisation (the Overview's Open GDPR duties → goes there) and worked under Frameworks → GDPR. They are grouped Establish · Map · Protect · Operate — governance policy, DPO decision, data-role determination and the record of processing activities; lawful-basis inventory, retention and DPIA methodology; security measures, the breach procedure (the supervisory authority within 72 hours of awareness under Art. 33), the data-subject-rights procedure and processor and transfer records; then privacy notices, training and the periodic review — plus a Conditional / specialist group: consent, the EU representative, international transfers, supervisory-authority cooperation, codes and certification. The groups are an order of work, not gates: no GDPR duty is ever locked. See Phases and gates.

Each duty opens with its guidance, questions, evidence examples and an Aria draft, and is approved like any record. The guidance carries a named reviewer's stamp. None of this waits for the standards' launch date — the GDPR is live now.

DPIA or FRIA? Both, once

A high-risk system used on people usually needs an Art. 35 DPIA and an EU AI Act Art. 27 fundamental-rights impact assessment. They overlap heavily, and the Act says so itself: Art. 27(4) lets the FRIA draw on a DPIA already carried out, and Art. 26(9) says a deployer uses the provider's instructions for use when doing that DPIA. Veritome shows both routes on the obligation and maps the FRIA's answers onto the DPIA's four pillars — see DPIA overlap. Neither route counts toward a completion figure or changes a status; one assessment does not discharge the other.

Incidents run on two clocks

A data breach involving an AI system can be both a GDPR breach and an EU AI Act serious incident. The incident register lets you say which law's clock an incident runs on — GDPR, EU AI Act, or both — so the 72-hour breach notification and the Art. 73 reporting deadlines are tracked side by side.

In Veritome

GDPR rows appear in the Obligations register in the GDPR hue — filter Source to GDPR to see only them. The Overview's GDPR runs beside the Act panel counts system duties and organisation duties apart and shows the state of the record of processing activities. The records — the RoPA, the DPIA methodology, the breach procedure, the privacy notices — are rows in Documents with GDPR as their Source, each opening the duty that produces it.