DATA & PRIVACY · 9 MIN READ

AI and Data Protection: Where Organisational Obligations Overlap.

New AI rules do not replace existing data protection obligations. Organisations need to understand where AI governance, privacy, transparency and automated decision-making requirements intersect.

INTAI Research · Published 23 June 2026

Read the Update

Two Regulatory Regimes, Applying at Once

A common and consequential misunderstanding is treating AI-specific regulation as a replacement for existing data protection law. It is not. Where an AI system processes personal data, which describes the large majority of AI systems actually deployed inside organisations, GDPR (or UK GDPR) continues to apply in full, alongside whatever AI-specific obligations attach to the system separately.

The two regimes are now being deliberately connected rather than left to overlap by accident. The European Data Protection Board and the European Commission are developing joint guidelines specifically on the interplay between GDPR and the AI Act, expected through 2026 with a final version anticipated by year end, addressing directly how AI-driven targeting, profiling and automated decision-making should be assessed under both frameworks simultaneously.

Where the Two Frameworks Explicitly Connect

The clearest point of overlap is the Data Protection Impact Assessment. Article 26(9) of the AI Act requires deployers of high-risk AI systems to use the technical information their provider is required to supply under Article 13 to help fulfil their existing DPIA obligation under GDPR Article 35, making the AI Act's transparency requirements a direct input into an organisation's data protection compliance, rather than a parallel, disconnected exercise. A revised EDPB DPIA template, due in early 2026, explicitly addresses this AI Act intersection.

The second major point of connection is automated decision-making under GDPR Article 22, which restricts decisions based solely on automated processing that produce legal or similarly significant effects on an individual, subject to specific exceptions and safeguards. The AI Act’s human oversight requirements for high-risk systems sit alongside this existing right, and the forthcoming joint guidance is expected to clarify how the two sets of requirements, GDPR’s individual right and the AI Act’s systemic oversight obligation, are meant to function together rather than as two separate compliance boxes to tick independently.

Central Insight

An AI system that satisfies its AI Act obligations but was never assessed against GDPR, or vice versa, is not actually compliant, only partially so. The organisations handling this well are running a single combined assessment process for any AI system touching personal data, rather than two separate workstreams that each assume the other has covered the gap.

What This Means in Practice

For most organisations, the practical implication is procedural rather than requiring an entirely new compliance function: AI risk assessment and data protection impact assessment need to happen together, informed by the same underlying system documentation, for any AI system that processes personal data.

That means the technical documentation an AI provider supplies under the AI Act’s transparency obligations should be treated as a direct input to the organisation’s DPIA process, not a separate compliance artefact filed away unused. It means automated decision-making use cases should be reviewed against both GDPR Article 22 and the AI Act’s human oversight requirements in the same sitting. And with 2026 GDPR enforcement remaining active, the EDPB’s 2025 annual report recorded €1.15 billion in GDPR fines across the EU, treating data protection as a separate, lower-priority workstream from AI governance is a genuine and currently underappreciated compliance risk.