{"course":{"slug":"choosing-your-tools","title":"Choosing and Using the Tools","url":"https://addaly.com/learn/choosing-your-tools","level":"beginner","track":"work"},"lesson":{"slug":"your-country-your-rules","title":"Your country, your rules","url":"https://addaly.com/learn/choosing-your-tools/your-country-your-rules","position":51,"of":76,"minutes":9,"answer":"Most data protection regimes share the same shape (you are the one deciding, you need a lawful basis and a purpose, people have rights.","keyIdea":"Most data protection regimes share the same shape (you are the one deciding, you need a lawful basis and a purpose, people have rights, and sending data abroad is restricted) and your profession's rules sit on top of your country's."},"body":{"format":"markdown","text":"## Why this lesson cannot give you an answer\n\nData protection law differs by country, changes regularly, and applies differently depending on what you do and who your users are. Nothing here is legal advice, and anyone giving you a confident universal answer is guessing. What this lesson can do is show you the **shape** of the questions, so you know what to ask and whom to ask.\n\n## The pattern most of these laws share\n\nDespite the differences, a common structure has spread widely: Europe's GDPR, India's DPDP Act, Brazil's LGPD, South Africa's POPIA, China's PIPL and others share most of these elements:\n\n**A distinction between the person who decides and the service that executes.** In European terms, controller and processor. If you decide to send a customer's details to an AI service, you are the one deciding, and most obligations sit with you rather than with the provider.\n\n**A requirement for a lawful basis.** You need a reason to process personal data, and \"it was convenient\" is not one. Consent, contract, and legitimate interests are the usual candidates, and which applies is a real question.\n\n**Purpose limitation.** Data collected for one purpose cannot casually be used for another. Feeding your customer database into a model to see what it finds is exactly the kind of thing this restricts.\n\n**Rights for the individual.** Access, correction, deletion, and in some regimes objection to automated decision-making. That last one matters here: several regimes give people the right not to be subject to a purely automated decision with significant effects, which constrains using a model to decide about people without a human involved.\n\n**Rules on sending data abroad.** Most of these laws restrict transferring personal data outside the country or region without a lawful mechanism. Since most AI processing happens in a handful of countries, this is where the practical friction lands.\n\n**Breach notification.** A duty to report certain incidents within a stated time, often 72 hours.\n\n## Sector rules on top\n\nWhatever your national law says, your profession may say more. Health, legal, financial, educational and government work carry additional duties, often with specific rules about disclosure to third parties, and those duties are usually owed regardless of what the tool's terms say. A clinician's obligation to a patient does not change because a service promised not to train on the note.\n\nIf you work in one of these fields, the question to ask is not \"is this tool safe\" but \"does my professional body have guidance on this\", and increasingly the answer is yes.\n\n## What actually changes what you do\n\nThree practical consequences cover most situations:\n\n**Personal data means somebody's name, contact details, identifiers, or anything that could identify them.** It is a wider category than people assume: a case reference plus a date of birth is personal data.\n\n**Where processing happens matters, and you can often choose.** Regional endpoints, EU-hosted providers, and local models are the three answers, in ascending order of certainty.\n\n**The tool you choose is a decision you may have to justify.** Not to prove it was the best choice, but to show you thought about it. A dated note saying what you considered is the whole of what \"due diligence\" means in practice for a small operation.\n\n## Automated decisions about people\n\nOne provision is worth singling out because it catches ordinary uses. Several regimes restrict decisions made about a person purely by automated means where the effect on them is significant: a rejected application, a refused loan, a disciplinary outcome, a candidate screened out.\n\nThe practical reading is that using a model to *help* you decide is different from letting it decide. Keeping a person in the loop who reviews and can overrule, and recording that they did, is what separates the two. If you are sorting job applications, assessing tenants or triaging benefit claims, this is the provision to look up for your own jurisdiction before you build the process, not after.\n\n## The limitation\n\nThis area is unsettled and moving. The EU's AI Act phases in obligations over several years; several countries are drafting AI-specific rules; enforcement priorities shift; and how existing data protection law applies to model training is being argued in courts and regulators' offices right now.\n\nAnyone who tells you where the line is has told you where they think it is. Check the current position for your own country and your own profession, from a primary source, and treat everything written more than a year ago, including this, as a description of a moving thing."},"check":{"question":"A small clinic wants to use an assistant on patient notes. Which question does the shared structure of these laws make most important?","options":[{"text":"Whether the provider is certified to a recognised security standard.","correct":false,"tempting":"Checks organisational discipline, which is evidence for a decision rather than the decision, and says nothing about lawful basis or transfer."},{"text":"Whether the notes carry identifiers, what lawful basis covers sending them, and where it is processed.","correct":true},{"text":"Whether the model is accurate enough on clinical language to be safe for the intended use.","correct":false,"tempting":"Raises a real clinical-safety question that sits outside data protection law and does not answer whether the sending is permitted at all."},{"text":"Whether patients have already given general consent to their notes being processed by any kind of computer system.","correct":false,"tempting":"Treats a general consent as sufficient, when purpose limitation means consent to one processing does not extend to another."}]},"prev":{"slug":"what-a-business-agreement-buys","title":"What a business agreement actually buys","url":"https://addaly.com/learn/choosing-your-tools/what-a-business-agreement-buys"},"next":{"slug":"who-owns-the-output","title":"Who owns what it produces","url":"https://addaly.com/learn/choosing-your-tools/who-owns-the-output"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Your country, your rules', in Choosing and Using the Tools. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/choosing-your-tools/your-country-your-rules (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Your country, your rules","courseTitle":"Choosing and Using the Tools","module":{"index":6,"slug":"data-terms-and-law","title":"Data, terms and the law"},"answer":null,"keyIdea":"Most data protection regimes share the same shape (you are the one deciding, you need a lawful basis and a purpose, people have rights, and sending data abroad is restricted) and your profession’s rules sit on top of your country’s.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"why-this-lesson-cannot-give-you-an-answer","runs":[{"text":"Why this lesson cannot give you an answer"}]},{"t":"p","runs":[{"text":"Data protection law differs by country, changes regularly, and applies differently depending on what you do and who your users are. Nothing here is legal advice, and anyone giving you a confident universal answer is guessing. What this lesson can do is show you the "},{"text":"shape","b":true},{"text":" of the questions, so you know what to ask and whom to ask."}]},{"t":"h2","id":"the-pattern-most-of-these-laws-share","runs":[{"text":"The pattern most of these laws share"}]},{"t":"p","runs":[{"text":"Despite the differences, a common structure has spread widely: Europe’s GDPR, India’s DPDP Act, Brazil’s LGPD, South Africa’s POPIA, China’s PIPL and others share most of these elements:"}]},{"t":"p","runs":[{"text":"A distinction between the person who decides and the service that executes.","b":true},{"text":" In European terms, controller and processor. If you decide to send a customer’s details to an AI service, you are the one deciding, and most obligations sit with you rather than with the provider."}]},{"t":"p","runs":[{"text":"A requirement for a lawful basis.","b":true},{"text":" You need a reason to process personal data, and “it was convenient” is not one. Consent, contract, and legitimate interests are the usual candidates, and which applies is a real question."}]},{"t":"p","runs":[{"text":"Purpose limitation.","b":true},{"text":" Data collected for one purpose cannot casually be used for another. Feeding your customer database into a model to see what it finds is exactly the kind of thing this restricts."}]},{"t":"p","runs":[{"text":"Rights for the individual.","b":true},{"text":" Access, correction, deletion, and in some regimes objection to automated decision-making. That last one matters here: several regimes give people the right not to be subject to a purely automated decision with significant effects, which constrains using a model to decide about people without a human involved."}]},{"t":"p","runs":[{"text":"Rules on sending data abroad.","b":true},{"text":" Most of these laws restrict transferring personal data outside the country or region without a lawful mechanism. Since most AI processing happens in a handful of countries, this is where the practical friction lands."}]},{"t":"p","runs":[{"text":"Breach notification.","b":true},{"text":" A duty to report certain incidents within a stated time, often 72 hours."}]},{"t":"h2","id":"sector-rules-on-top","runs":[{"text":"Sector rules on top"}]},{"t":"p","runs":[{"text":"Whatever your national law says, your profession may say more. Health, legal, financial, educational and government work carry additional duties, often with specific rules about disclosure to third parties, and those duties are usually owed regardless of what the tool’s terms say. A clinician’s obligation to a patient does not change because a service promised not to train on the note."}]},{"t":"p","runs":[{"text":"If you work in one of these fields, the question to ask is not “is this tool safe” but “does my professional body have guidance on this”, and increasingly the answer is yes."}]},{"t":"h2","id":"what-actually-changes-what-you-do","runs":[{"text":"What actually changes what you do"}]},{"t":"p","runs":[{"text":"Three practical consequences cover most situations:"}]},{"t":"p","runs":[{"text":"Personal data means somebody’s name, contact details, identifiers, or anything that could identify them.","b":true},{"text":" It is a wider category than people assume: a case reference plus a date of birth is personal data."}]},{"t":"p","runs":[{"text":"Where processing happens matters, and you can often choose.","b":true},{"text":" Regional endpoints, EU-hosted providers, and local models are the three answers, in ascending order of certainty."}]},{"t":"p","runs":[{"text":"The tool you choose is a decision you may have to justify.","b":true},{"text":" Not to prove it was the best choice, but to show you thought about it. A dated note saying what you considered is the whole of what “due diligence” means in practice for a small operation."}]},{"t":"h2","id":"automated-decisions-about-people","runs":[{"text":"Automated decisions about people"}]},{"t":"p","runs":[{"text":"One provision is worth singling out because it catches ordinary uses. Several regimes restrict decisions made about a person purely by automated means where the effect on them is significant: a rejected application, a refused loan, a disciplinary outcome, a candidate screened out."}]},{"t":"p","runs":[{"text":"The practical reading is that using a model to "},{"text":"help","i":true},{"text":" you decide is different from letting it decide. Keeping a person in the loop who reviews and can overrule, and recording that they did, is what separates the two. If you are sorting job applications, assessing tenants or triaging benefit claims, this is the provision to look up for your own jurisdiction before you build the process, not after."}]},{"t":"h2","id":"the-limitation","runs":[{"text":"The limitation"}],"role":"limit"},{"t":"p","runs":[{"text":"This area is unsettled and moving. The EU’s AI Act phases in obligations over several years; several countries are drafting AI-specific rules; enforcement priorities shift; and how existing data protection law applies to model training is being argued in courts and regulators’ offices right now."}]},{"t":"p","runs":[{"text":"Anyone who tells you where the line is has told you where they think it is. Check the current position for your own country and your own profession, from a primary source, and treat everything written more than a year ago, including this, as a description of a moving thing."}]}],"check":{"question":[{"text":"A small clinic wants to use an assistant on patient notes. Which question does the shared structure of these laws make most important?"}],"options":[{"text":[{"text":"Whether the provider is certified to a recognised security standard."}],"correct":false,"tempting":[{"text":"Checks organisational discipline, which is evidence for a decision rather than the decision, and says nothing about lawful basis or transfer."}]},{"text":[{"text":"Whether the notes carry identifiers, what lawful basis covers sending them, and where it is processed."}],"correct":true,"tempting":null},{"text":[{"text":"Whether the model is accurate enough on clinical language to be safe for the intended use."}],"correct":false,"tempting":[{"text":"Raises a real clinical-safety question that sits outside data protection law and does not answer whether the sending is permitted at all."}]},{"text":[{"text":"Whether patients have already given general consent to their notes being processed by any kind of computer system."}],"correct":false,"tempting":[{"text":"Treats a general consent as sufficient, when purpose limitation means consent to one processing does not extend to another."}]}],"order":[2,3,0,1],"why":null},"prev":{"slug":"what-a-business-agreement-buys","title":"What a business agreement actually buys","minutes":8},"next":{"slug":"who-owns-the-output","title":"Who owns what it produces","minutes":8}}}