---
title: "GDPR"
description: "GDPR regulates personal data of EU residents and applies globally. Why sending EU personal data to AI tools triggers processing, transfer, and subject-rights questions."
url: "https://sonomos.ai/glossary/gdpr/"
source: "https://sonomos.ai/glossary/gdpr/"
---

# GDPR

The EU General Data Protection Regulation — the world's most comprehensive data-protection law, governing how organisations handle personal data of EU residents.

## In depth

The General Data Protection Regulation (GDPR, EU 2016/679) regulates the processing of personal data of people in the EU and EEA. It applies to any organisation that targets or monitors EU residents, regardless of where the organisation is based. GDPR introduces concepts now common across global privacy law: lawful bases for processing, data subject rights (access, deletion, portability, objection), data protection by design, and substantial fines (up to 4% of global revenue). Sending EU personal data to a U.S.-based AI service raises a stack of GDPR concerns: lawful basis, processor agreements, cross-border transfer mechanisms, and data subject rights.

## Examples

- A Berlin-based consultancy pasting client emails into ChatGPT — a processing event under GDPR with the AI provider as processor (or sub-processor).
- A French recruiter routing CVs through a U.S. AI tool, triggering cross-border transfer rules.
- A Dutch healthcare administrator using a free AI summarisation tool on patient correspondence.

## How Locke handles gdpr

Locke detects patterns consistent with personal data and can mask or block before transmission. Because all detection is local, Sonomos itself is not a processor of EU personal data — there is no cross-border transfer to mediate, no DPA to negotiate, no new sub-processor to add to the chain.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Personally Identifiable Information (PII)

  Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- CCPA

  The California Consumer Privacy Act and its 2023 successor, the CPRA — the United States' most influential state-level privacy law.
- Pseudonymization

  Replacing direct identifiers with stable pseudonyms so the data can no longer identify a person without additional information held separately.

## Reading on this topic

- [GDPR Data Subject Rights and AI: Access, Erasure, and Automated Decisions in 2026](https://sonomos.ai/blog/gdpr-data-subject-rights-ai-2026/)
- [GDPR and AI: A 2026 Compliance Guide for European Teams Using ChatGPT, Claude, and Gemini](https://sonomos.ai/blog/gdpr-ai-compliance-eu-chatgpt-claude-gemini-2026/)
- [Is Grok GDPR Compliant? A 2026 Guide for European Teams](https://sonomos.ai/blog/is-grok-gdpr-compliant-2026/)
- [Is Gemini GDPR Compliant? A 2026 Guide for European Teams](https://sonomos.ai/blog/is-gemini-gdpr-compliant-2026/)