Skip to content

Regulation Tracker / European Union

Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

European Data Protection Board

last revised 2024-12-17last verified 2026-09-041 versioncountry page →

GuidanceIn forceConfidentialityRecord-keepingClient consent

map categories:Data protection and legal AIClient data in AI toolsVendor due diligence

An EDPB opinion adopted on 17 December 2024 answering when an AI model can be treated as anonymous, how controllers justify legitimate interest at the development and deployment stages, and what follows if training data was processed unlawfully. It matters to law firms and legal-tech vendors deploying AI on personal data in the EU.

Applies to
providers, firms, all
Effective
See version history
Current version
Adopted · 17 Dec 2024
Last verified
04 Sept 2026
Official text
www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_…

What the document requires

  • Anonymity of an AI model must be assessed case by case; the mere absence of stored personal data is not enough.
  • Applies the three-step legitimate interest assessment from Guidelines 1/2024 to AI development and deployment.
  • Unlawful processing at the development stage may lead supervisory authorities to order fines, processing limitations, dataset erasure or model retraining.

Version history

VersionDateWhat changedSource
Adoptedcurrent2024-12-17Original opinion adopted under Article 64(2) GDPR at the request of the Irish supervisory authority.official

Sources

Cite this record

SafeLegalAI Legal AI Regulation Tracker, "Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models" (European Data Protection Board, Adopted, 2024-12-17), safelegalai.com/regulation/eu/eu-edpb-opinion-28-2024-ai-models (accessed 2026-09-04). Data: CC BY 4.0.

More official documents in European Union