Your country, your rules

Why this lesson cannot give you an answer

Data protection law differs by country, changes regularly, and applies differently depending on what you do and who your users are. Nothing here is legal advice, and anyone giving you a confident universal answer is guessing. What this lesson can do is show you the shape of the questions, so you know what to ask and whom to ask.

The pattern most of these laws share

Despite the differences, a common structure has spread widely: Europe’s GDPR, India’s DPDP Act, Brazil’s LGPD, South Africa’s POPIA, China’s PIPL and others share most of these elements:

A distinction between the person who decides and the service that executes. In European terms, controller and processor. If you decide to send a customer’s details to an AI service, you are the one deciding, and most obligations sit with you rather than with the provider.

A requirement for a lawful basis. You need a reason to process personal data, and “it was convenient” is not one. Consent, contract, and legitimate interests are the usual candidates, and which applies is a real question.

Purpose limitation. Data collected for one purpose cannot casually be used for another. Feeding your customer database into a model to see what it finds is exactly the kind of thing this restricts.

Rights for the individual. Access, correction, deletion, and in some regimes objection to automated decision-making. That last one matters here: several regimes give people the right not to be subject to a purely automated decision with significant effects, which constrains using a model to decide about people without a human involved.

Rules on sending data abroad. Most of these laws restrict transferring personal data outside the country or region without a lawful mechanism. Since most AI processing happens in a handful of countries, this is where the practical friction lands.

Breach notification. A duty to report certain incidents within a stated time, often 72 hours.

Sector rules on top

Whatever your national law says, your profession may say more. Health, legal, financial, educational and government work carry additional duties, often with specific rules about disclosure to third parties, and those duties are usually owed regardless of what the tool’s terms say. A clinician’s obligation to a patient does not change because a service promised not to train on the note.

If you work in one of these fields, the question to ask is not “is this tool safe” but “does my professional body have guidance on this”, and increasingly the answer is yes.

What actually changes what you do

Three practical consequences cover most situations:

Personal data means somebody’s name, contact details, identifiers, or anything that could identify them. It is a wider category than people assume: a case reference plus a date of birth is personal data.

Where processing happens matters, and you can often choose. Regional endpoints, EU-hosted providers, and local models are the three answers, in ascending order of certainty.

The tool you choose is a decision you may have to justify. Not to prove it was the best choice, but to show you thought about it. A dated note saying what you considered is the whole of what “due diligence” means in practice for a small operation.

Automated decisions about people

One provision is worth singling out because it catches ordinary uses. Several regimes restrict decisions made about a person purely by automated means where the effect on them is significant: a rejected application, a refused loan, a disciplinary outcome, a candidate screened out.

The practical reading is that using a model to help you decide is different from letting it decide. Keeping a person in the loop who reviews and can overrule, and recording that they did, is what separates the two. If you are sorting job applications, assessing tenants or triaging benefit claims, this is the provision to look up for your own jurisdiction before you build the process, not after.

The limitation

This area is unsettled and moving. The EU’s AI Act phases in obligations over several years; several countries are drafting AI-specific rules; enforcement priorities shift; and how existing data protection law applies to model training is being argued in courts and regulators’ offices right now.

Anyone who tells you where the line is has told you where they think it is. Check the current position for your own country and your own profession, from a primary source, and treat everything written more than a year ago, including this, as a description of a moving thing.