Module 5: GDPR for AI Systems
Project: GDPR Compliance Checklist for AI
Description
We close M5 with an actionable deliverable: a GDPR Compliance Checklist specific to AI systems. It isn't generic — it's for your concrete system.
This checklist becomes part of the Responsible AI Framework (M7) and the Ethics Audit Report (M8). It's a reusable artifact for every future AI project.
By the end of this project you'll have:
- A GDPR Compliance Checklist (25-30 verifiable items) specific to AI
- Each item with: a criterion, a status (Yes/No/N/A), and the evidence required
- Categorized by area: Art. 22, consent, minimization, documentation, DPO
- Ready to apply in an internal or external audit
The checklist template
# GDPR Compliance Checklist — AI Systems
**Version**: 1.0
**Last reviewed**: 2026-MM-DD
**Reviewer**: [Name]
**System**: [System name]
## Section 1: Automated Decision-Making (Art. 22)
[ ] 1.1 Does the system make decisions solely based on automated processing
that produce legal effects or similarly significantly affect users?
- Yes → Continue to 1.2-1.6
- No → Skip to Section 2
Evidence: [link to decision flow diagram]
[ ] 1.2 Does the system fall under one of the Art. 22(2) exceptions?
- (a) Contract necessity
- (b) Authorized by Union/Member State law
- (c) Explicit consent
Evidence: [link to legal basis documentation]
[ ] 1.3 Is meaningful information about the logic involved provided to data subjects?
Evidence: [link to user-facing explanation samples]
[ ] 1.4 Are the consequences of the decision communicated clearly?
Evidence: [link to notification templates]
[ ] 1.5 Can data subjects obtain human intervention upon request?
- Process documented and operational
Evidence: [link to human review workflow + SLA]
[ ] 1.6 Can data subjects contest the decision?
- Process documented
Evidence: [link to appeal process]
## Section 2: Lawful Basis (Art. 6)
[ ] 2.1 Each processing activity has a documented lawful basis
Evidence: [link to RoPA showing basis per activity]
[ ] 2.2 If consent is used:
- Specific, granular consent for AI processing
- Separate from other consents
- Revocable as easily as granted
Evidence: [link to consent UX + flow + logs]
[ ] 2.3 If legitimate interest is used:
- LIA documented and current
- Right to object implemented
Evidence: [link to LIA + objection process]
[ ] 2.4 No sensitive data (Art. 9) processed without a specific Art. 9 basis
Evidence: [data inventory showing no sensitive data without a basis]
## Section 3: Data Minimization (Art. 5(1)(c))
[ ] 3.1 Training data necessity documented per field
Evidence: [link to data inventory with justifications]
[ ] 3.2 Anonymization or pseudonymization applied where possible
Evidence: [link to anonymization procedure]
[ ] 3.3 Excessive data fields removed (only necessary fields retained)
Evidence: [comparison of "available" vs "used" fields]
[ ] 3.4 Inference data minimal — only what's needed for the current query
Evidence: [code review samples / inference logs]
## Section 4: Transparency (Art. 12-14)
[ ] 4.1 Privacy policy clearly mentions AI processing
Evidence: [link to privacy policy with AI section]
[ ] 4.2 Users informed of automated decision-making (where applicable)
Evidence: [user-facing notifications]
[ ] 4.3 Cookie/consent banner specifically lists AI processing
Evidence: [screenshot of banner]
[ ] 4.4 Data subject can request information about the data held about them
Evidence: [data export/access process]
## Section 5: Data Subject Rights (Art. 15-22)
[ ] 5.1 Right of access — the data subject can obtain a copy of their data
- SLA: 1 month
Evidence: [process documentation]
[ ] 5.2 Right to rectification — corrections can be made
Evidence: [correction process + verification]
[ ] 5.3 Right to erasure — data deletion supported
- Including the impact on trained models documented
Evidence: [deletion process + model implications]
[ ] 5.4 Right to portability — data exportable in a machine-readable format
Evidence: [export endpoint or download feature]
[ ] 5.5 Right to object — objection mechanism functional
Evidence: [process + SLA + handling docs]
[ ] 5.6 Right to challenge automated decisions (Art. 22(3))
Evidence: [human review process]
## Section 6: International Transfers (Art. 44-50)
[ ] 6.1 All third-country transfers identified
Evidence: [data flow mapping]
[ ] 6.2 Adequate safeguards in place (SCCs, BCRs, or an adequacy decision)
Evidence: [link to SCCs with each processor]
[ ] 6.3 Privacy policy mentions international transfers
Evidence: [policy section]
## Section 7: Security (Art. 32)
[ ] 7.1 Encryption at rest implemented
Evidence: [config docs]
[ ] 7.2 Encryption in transit (TLS 1.2+)
Evidence: [SSL config]
[ ] 7.3 Access controls (RBAC) implemented
Evidence: [access matrix]
[ ] 7.4 Audit logs maintained
Evidence: [log samples + retention policy]
[ ] 7.5 Breach notification procedure documented
- 72-hour notification capability
Evidence: [incident response runbook]
## Section 8: Documentation (Art. 30)
[ ] 8.1 Records of Processing Activities (RoPA) maintained
Evidence: [link to RoPA]
[ ] 8.2 RoPA reviewed annually
Evidence: [last review date documented]
[ ] 8.3 DPIA conducted for high-risk processing
Evidence: [link to DPIA]
[ ] 8.4 DPIA reviewed when significant changes occur
Evidence: [DPIA version history]
## Section 9: DPO
[ ] 9.1 DPO designation decision documented
- Required (with justification) OR designated as best practice
Evidence: [decision documentation]
[ ] 9.2 If a DPO is designated:
- Contact info published
- Independence assured
Evidence: [organizational chart + privacy policy]
## Section 10: AI-Specific
[ ] 10.1 Training data sources documented
Evidence: [data inventory]
[ ] 10.2 Bias testing conducted (link to the M2 bias audit)
Evidence: [bias audit report]
[ ] 10.3 Model decisions can be logged and reconstructed
Evidence: [logging architecture]
[ ] 10.4 Re-training procedure documented (for the impact of erasure requests)
Evidence: [training procedure]
[ ] 10.5 Third-party AI services (OpenAI, etc.) have DPAs in place
Evidence: [DPAs with each provider]
## Status Summary
- Total items: 30
- Yes: __
- No: __
- N/A: __
- Compliance percentage: __%
## Critical Gaps (No items)
1. [Item number and brief description]
2. ...
## Action Plan
| Item | Priority | Owner | Target date |
|------|----------|-------|-------------|
| ... | Critical/High/Medium | ... | ... |
---
## Review schedule
- Quarterly: review changes to the system that affect compliance
- Annually: a full re-review of all items
- Ad-hoc: on major changes (a new model, a new data source, a new processing activity)How to work through the project
I suggest this order (~3 hours):
- Setup (15 min): copy the template, fill in the metadata
- Section 1 (Art. 22) (30 min): analyze your system for automated decisions
- Sections 2-3 (Bases + Minimization) (45 min): document each processing activity
- Sections 4-5 (Transparency + Rights) (30 min): your user-facing processes
- Sections 6-7 (Transfers + Security) (20 min): infrastructure docs
- Sections 8-9 (Documentation + DPO) (15 min): organizational
- Section 10 (AI-Specific) (20 min): your AI components
- Status summary + Action plan (15 min): prioritize the gaps
Total: ~3 hours for a defensible initial version.
Evaluation criteria
Your checklist is production-ready if:
- Every item has a definitive status (no "TBD")
- Every "Yes" has an evidence link/reference
- Every "No" is in the action plan
- The action plan has priorities and owners
- A review schedule is defined
- It's versioned (this is v1.0; future updates tracked)
How it integrates with the other modules
| Module | How it feeds this checklist |
|---|---|
| M3 (Privacy fundamentals) | Section 3 (minimization), Section 4 (transparency) |
| M4 (EU AI Act) | Section 1 (Art. 22 overlap), Section 10 (high-risk) |
| M6 (Standards) | Section 7 (security maps to ISO controls) |
| M7 (Framework) | This checklist becomes part of the framework |
| M8 (Ethics Audit) | This checklist gets applied during the audit |
Evidence of success when you finish M5
You'll know you finished well if:
- ✅ The checklist is complete with 25-30+ items, each one verifiable
- ✅ A status is defined for every item (no TBDs)
- ✅ Evidence is linked or referenced for every Yes
- ✅ There's an action plan for every No
- ✅ A review schedule + ownership are defined
- ✅ The checklist could pass an external audit (a DPA inspection)
Module 5 complete
You went from "GDPR is complex and vague" to having concrete tools:
- ✅ Art. 22 (automated decisions) in detail
- ✅ The right to explanation for LLMs, with practical strategies
- ✅ Data minimization applied to training + inference
- ✅ Granular consent vs. Legitimate Interest
- ✅ Documentation + DPO + DPIA
- ✅ An actionable checklist
Next module
Module 6 — Industry Standards and Frameworks. You have the regulation (EU AI Act M4, GDPR M5). Now you learn the voluntary standards (NIST AI RMF, IEEE 7000, ISO 42001) that complement regulation with implementable processes.
Resources
- ICO GDPR Compliance Checklist.
- EDPB Compliance Templates.
- GDPR enforcement tracker — to learn from violations.
- OneTrust / TrustArc tools — compliance software.
- Privacy Patterns library — design patterns for privacy.