Data privacy regulation governs how personal data is obtained, stored, processed, disclosed, shared, and disposed of. It aims to protect individual rights and hold organizations accountable for their handling of identifiable information. section 3.13 section 3.14
These rules developed from concerns about government databases in the 1970s and 1980s. Early national laws emphasized accuracy and security; later frameworks expanded toward accountability and broader individual protections. section 3.14
Core regulatory concerns include:
- Limiting collection, controlling disclosure and secondary use, enabling record correction, and protecting data security. section 3.14
- Requiring accountability for how organizations obtain, use, store, and share personal data. section 3.14
- Assessing whether artificial intelligence systems have a lawful basis, adequate transparency, and appropriate user controls. section 3.13
Privacy enforcement around language models
In 2023, Italy’s data protection authority temporarily restricted ChatGPT over concerns about transparency, lawful processing, and age verification. In 2025, European Union regulators investigated DeepSeek over possible processing of residents’ personal data without a clear legal basis. These cases illustrate that enforcement practices for language models remain unsettled. section 3.13
Figure 3.4 A timeline of data protection laws
A timeline connects early national privacy laws, international principles, the Data Protection Directive, and the General Data Protection Regulation. section 3.14
