When an organization collects or processes personal data, it must have a lawful basis: a legally recognized justification under the General Data Protection Regulation (GDPR). Public availability does not remove these protections. section 3.15
The GDPR recognizes six lawful bases for processing personal data:
- Consent section 3.15
- Contractual necessity section 3.15
- Legal obligation section 3.15
- Vital interests section 3.15
- Public task section 3.15
- Legitimate interest, which carries specific legal and accountability requirements section 3.15
Generative AI under regulatory scrutiny
Italy’s data protection authority temporarily restricted ChatGPT in March 2023 partly because OpenAI had not clearly established a lawful basis for processing personal data. The authority indicated that OpenAI would need explicit consent or a defensible legitimate-interest argument. Regulators continue to debate how these requirements apply to training data, opt-outs, and large language models, including in inquiries involving DeepSeek. section 3.15 section 3.13
