Privacy & Compliance
Training

AI Basics for Everyone is an EU AI Act course for every employee, not only the teams that build or buy AI. It starts with What Counts as AI, which teaches the legal definition of an AI system and the difference between provider and deployer.

Labeling AI and Deepfakes covers when AI content needs a label. Using AI Within the Law covers data protection, copyright and employment law, and When AI Use Goes Wrong shows what misuse costs the company and the employee.

GDPR Article 7 requires that consent be freely given, specific, informed, and unambiguous. Organizations must use clear affirmative action like unticked checkboxes, keep records proving when and how consent was obtained, and make withdrawal as easy as opting in.

Pre-ticked boxes, bundled consent, and vague privacy policies do not meet the standard. Regulators have imposed over EUR 400M in fines related to consent violations.

Under GDPR Article 33, organizations must notify their supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals.

The notification must include the nature of the breach, approximate number of affected individuals, likely consequences, and measures taken. British Airways was fined GBP 20M for the security failures behind its 2018 breach.

Privacy by design, codified in GDPR Article 25, requires organizations to integrate data protection into the design of systems and processes from the start, not bolt it on afterward. This includes data minimization, purpose limitation, and privacy-protective default settings.

The concept originated with Ann Cavoukian's seven foundational principles in the 1990s and became a legal obligation when the GDPR took effect in 2018.

A Data Subject Access Request (DSAR) is a right under GDPR Article 15 allowing any individual to request a copy of the personal data an organization holds about them.

Organizations must respond within 30 days, provide the data in an accessible format, and include information about processing purposes, retention periods, and third-party recipients. Requests can arrive through any channel, including email, web forms, or verbal communication.

Article 28 requires a written contract, called a Data Processing Agreement (DPA), between the controller and every processor handling personal data. The DPA must specify the processing purpose, data types, duration, and security measures.

Processors can only engage sub-processors with prior written authorization from the controller. The processor must assist with DSARs, breach notification, and data deletion, and submit to audits by the controller.

The OWASP Top 10 Privacy Risks is an industry framework that identifies the ten most common ways organizations mishandle personal data.

It covers web application vulnerabilities that leak PII, operator-sided data leakage, insufficient breach response, bundled consent, non-transparent policies, failed data deletion, poor data quality, missing session expiration, blocked data subject access, and excessive data collection. The framework helps organizations assess and mitigate privacy risks beyond regulatory compliance.

The OWASP Top 10 Privacy Risks overlaps significantly with GDPR requirements. For example, OWASP P3 (Insufficient Data Breach Response) maps to GDPR Article 33 breach notification, P4 (Consent on Everything) maps to Article 7 consent requirements, P6 (Insufficient Deletion) maps to Article 17 right to erasure, and P9 (Inability to Access Data) maps to Article 15 data subject access rights.

Training on both frameworks gives teams a complete picture of privacy obligations.

Article 4 of the EU AI Act requires providers and deployers to take measures to support the development of AI literacy of their staff, the wording since the 2026 Digital Omnibus. The duty has applied since February 2, 2025, and scales with each role and the systems staff use. In practice that means staff understand how AI generates outputs, its limitations including hallucinations, and the data privacy implications of using AI tools.

Articles 14 and 26 add competency requirements for human oversight of high-risk AI systems from December 2, 2027, and Article 50 requires transparency disclosure for AI chatbots and AI-generated content. Failure to train staff on these requirements creates direct exposure to enforcement actions.

The two frameworks are independent but overlapping. When an AI system processes personal data, both apply simultaneously. GDPR Article 22 grants individuals the right not to be subject to automated decisions with legal effects, and that right attaches regardless of how the EU AI Act classifies the system.

For high-risk AI systems processing personal data, organizations may need both a GDPR Data Protection Impact Assessment (DPIA) under Article 35 and a Fundamental Rights Impact Assessment (FRIA) under Article 27 of the EU AI Act. One does not replace the other.

Tier 1 covers Article 5 prohibited AI practices and reaches 35 million euros or 7% of global annual turnover, whichever is higher. Tier 2 covers most operator obligations, including those for high-risk AI, and reaches 15 million euros or 3%; GPAI model providers face the same ceiling under Article 101. Tier 3 covers supplying incorrect, incomplete, or misleading information to authorities and reaches 7.5 million euros or 1%.

Beyond fines, national market surveillance authorities can suspend non-compliant systems, require market withdrawal, publicly disclose violations, and mandate corrective measures. The fines fall on organizations, not individual employees, though staff who knowingly mislead an authority can face disciplinary action and penalties under national law.