Privacy in AI processes is decided by concrete questions: is this data still personal data, what did the model see, and how long is it kept? This hub follows the guidance and decisions that answer those questions, with named sources.
The pillar articles set out the framework for scraping, anonymisation and demonstrable control over privacy-sensitive files. The other articles work out the individual distinctions.
Start here
EDPB Guidelines 02/2026 clarify when AI data is truly anonymous and when pseudonymised data stays under the GDPR, with consequences for training and inference.
July 17, 2026
Recent guidance from the BSB, CCBE, ABA and the EU AI Act shows that generative AI touches professional secrecy. What does that mean for lawyers using AI?
August 18, 2026
The EDPB clarifies with Guidelines 03/2026 and 02/2026 how the GDPR applies to AI training, web scraping and anonymisation. What does that mean for your AI setup?
August 19, 2026
Why memory features in AI assistants have become a data-leak risk of their own, and how to treat memory as an explicit, securable data layer.
July 23, 2026
The EDPB guidelines on web scraping for generative AI make clear that training data fall under the GDPR. What this means for organisations.
August 24, 2026
The EDPB Guidelines 02/2026 make re-identifiability after anonymisation a testable, ongoing standard. What does that mean for high-trust data processing?
August 19, 2026
Guidance from the CNIL, EDPS and the EDPB template turns DPIAs for generative AI and AI agents into a design and verification tool, not a tick-box document.
August 6, 2026
Apple's WWDC 2026 and new research show that local AI is not automatically safer than cloud. Privacy becomes a verifiable architecture decision.
August 17, 2026
The EDPB and EU transparency rules of July 2026 make clear that AI with personal data is not only allowed, but must be demonstrably limited and visible.
July 27, 2026
New guidelines from Singapore and AI court cases show organisations remain responsible for privacy-sensitive data, even with external AI models.
August 5, 2026
New guidance on Articles 12 and 19 of the AI Act sets retention periods for AI logs, while the GDPR demands shorter retention for prompts with personal data.
August 4, 2026
EDPB guidelines on web scraping and unlearning research show that deletion requests in 2026 reach into model memory and demand demonstrable policy.
August 6, 2026
New CCBE guides and national advisories show that AI use by lawyers aligns with a verifiable confidentiality and verification approach for legal practice.
August 14, 2026
In 2026 the AI risk register is the demonstrable core of AI risk management. What NIST, the EDPS and the EU AI Act ask, and how to maintain it in practice.
August 25, 2026
Major AI providers quietly claim ownership and training rights over Usage Data outside visible customer data. What this means for high-trust workflows.