What legal basis do we have for using AI on personal data?
Short answer
Using AI on personal data needs a legal basis under Article 6 GDPR – like any other processing. Usually that is the contract with the customer, a legal obligation or your legitimate interests. AI doesn't change the basis, but you must check that the use fits the purpose the data was collected for (Article 6(4)). Sensitive data also needs an exception under Article 9. And a basis for using data is not the same as allowing an AI provider to train on it.
The usual legal bases
| Basis | Example |
|---|---|
| Contract (Article 6(1)(b)) | AI helps answer a customer's enquiry |
| Legal obligation (point (c)) | AI helps find data for a subject access request |
| Legitimate interests (point (f)) | AI finds patterns in customer enquiries to improve service |
| Consent (point (a)) | Personalised offers by email |
The compatibility test
If the AI use is a new purpose, you must assess the link with the original purpose, what the people can reasonably expect, which data is involved, the consequences for them and the safeguards you have – such as pseudonymisation. The GDPR names pseudonymisation directly as a safeguard in Article 6(4).
What to do
- Describe the purpose.What should the AI help with?
- Find the original purpose.Why did you collect the data?
- Check that they fit together.Link between purposes, expectations, the data, consequences and safeguards such as pseudonymisation.
- Choose the basis.Contract, legal obligation or legitimate interests – rarely consent.
- Write it down.In your AI register and your record of processing activities.
What the law says
- Article 6 GDPR – lawfulness of processing
- The six legal bases, and Article 6(4) on compatible purposes.
- EDPB Opinion 28/2024 on AI models
- On legitimate interests as a basis for developing and using AI models.
Questions and answers
Do we need consent to use AI?
Rarely. Consent can be withdrawn and is difficult in employment. Contract or legitimate interests are more often the right choice.
What is a balancing test?
An assessment of whether your interest in using AI outweighs the interests of the people concerned. Pseudonymisation counts in your favour.
Can we use customer data to train our own AI?
That is a new purpose, which needs a separate assessment – and often information to your customers.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.