Privacy in AI processes is decided by concrete questions: is this data still personal data, what did the model see, and how long is it kept? This hub follows the guidance and decisions that answer those questions, with named sources.
The pillar articles set out the framework for scraping, anonymisation and demonstrable control over privacy-sensitive files. The other articles work out the individual distinctions.
Start here
OpenAI, Google Cloud, Anthropic and Microsoft document that regional AI endpoints can run routing, authentication and CPU tasks outside the region.
July 17, 2026
Recent guidance from the BSB, CCBE, ABA and the EU AI Act shows that generative AI touches professional secrecy. What does that mean for lawyers using AI?
August 18, 2026
The EDPB clarifies with Guidelines 03/2026 and 02/2026 how the GDPR applies to AI training, web scraping and anonymisation. What does that mean for your AI setup?
August 19, 2026
Why memory features in AI assistants have become a data-leak risk of their own, and how to treat memory as an explicit, securable data layer.
July 23, 2026
The EDPB guidelines on web scraping for generative AI make clear that training data fall under the GDPR. What this means for organisations.
August 24, 2026
The EDPB Guidelines 02/2026 make re-identifiability after anonymisation a testable, ongoing standard. What does that mean for high-trust data processing?
September 15, 2026
On-device and edge AI can offer privacy benefits, but only if you audit the full data pipeline. Learn how to decide per workflow what stays local or uses the cloud.
September 14, 2026
How do you process confidential documents with AI without losing the context needed to reason? Recent research shows concrete architectures for doing so.
August 29, 2026
How regulated teams should evaluate document redlining software by tracing the data path, checking retention and audit controls, and testing output fidelity.
August 19, 2026
Guidance from the CNIL, EDPS and the EDPB template turns DPIAs for generative AI and AI agents into a design and verification tool, not a tick-box document.
September 21, 2026
The EDPB harmonises the GDPR fining methodology and finalises the DSA-GDPR guidelines. Here is how you link both regimes in one risk matrix and fine calculation.
September 16, 2026
Embeddings can contain traceable personal data. Learn which controls you need to scan, limit and demonstrably clean up vector databases.
October 9, 2026
GDPR Article 25 makes privacy by design a lifecycle engineering duty, covering four balancing factors, default obligations, pseudonymisation and evidence.
September 9, 2026
The EDPB web-scraping guidelines and the AP guidance bring generative AI under the GDPR. Here is how to divide responsibilities per workflow phase in concrete terms.
October 8, 2026
A privacy analysis by IMDEA Networks found third-party tracking and conversation fragments at AI services. What this means and how to verify dataflows per service.
August 6, 2026
Apple's WWDC 2026 and new research show that local AI is not automatically safer than cloud. Privacy becomes a verifiable architecture decision.
September 16, 2026
Multilingual privacy notices, DPIAs and AI output diverge across jurisdictions. Here is how to make translation and localisation a verifiable part of your
September 6, 2026
The Belgian regulator is handling the complaint against DPG's cookie wall. What this means for designing and checking your privacy gate as a workflow.
September 27, 2026
DPG Media presents the Privacy Gate as a transparent data mechanism, but the EDPB and AP set requirements for valid consent that an interface alone cannot meet.
August 17, 2026
The EDPB and EU transparency rules of July 2026 make clear that AI with personal data is not only allowed, but must be demonstrably limited and visible.
July 27, 2026
New guidelines from Singapore and AI court cases show organisations remain responsible for privacy-sensitive data, even with external AI models.
August 5, 2026
New guidance on Articles 12 and 19 of the AI Act sets retention periods for AI logs, while the GDPR demands shorter retention for prompts with personal data.
August 4, 2026
EDPB guidelines on web scraping and unlearning research show that deletion requests in 2026 reach into model memory and demand demonstrable policy.
August 6, 2026
New CCBE guides and national advisories show that AI use by lawyers aligns with a verifiable confidentiality and verification approach for legal practice.
August 14, 2026
In 2026 the AI risk register is the demonstrable core of AI risk management. What NIST, the EDPS and the EU AI Act ask, and how to maintain it in practice.
August 25, 2026
Major AI providers quietly claim ownership and training rights over Usage Data outside visible customer data. What this means for high-trust workflows.
September 11, 2026
Anthropic accuses DeepSeek and Moonshot of quietly forwarding prompts to Claude. Here is how to map, per workflow, where your prompts actually go.
October 8, 2026
The Dutch data protection authority fined Uber 824,990,000 euros for automated driver deactivation without genuine human intervention.
August 29, 2026
EDPB Guidelines 02/2026 clarify when AI data is truly anonymous and when pseudonymised data stays under the GDPR, with consequences for training and inference.