GDPR

The General Data Protection Regulation (GDPR) is the European Union's data-protection law, governing the processing of EU residents' personal data wherever in the world it happens. It codifies principles - lawfulness, purpose limitation, data minimization, storage limitation - and grants individuals rights over their data, backed by penalties that scale with global revenue.

For AI, several GDPR principles become concrete runtime controls: purpose limitation maps to binding each access to a declared purpose, data minimization to sending a model only the fields it needs, and residency to keeping data and its processing in-region. Expressing those as enforced policy - region-lock, field-level masking, purpose binding - is how a legal principle becomes something a system actually does on every request.