Key takeaways
- Early regulatory engagement with the DPC is put forward as the most effective path to sustainable, responsible data protection and privacy-centric innovation
- Good documentation facilitates efficient regulatory engagement
- Monitoring live launches and treating original risk assessments, DPIAs and LIAs as living documents can demonstrate responsible innovation and assist with developing safer products
- The DPC’s recurring areas of focus are transparency, lawful basis, data minimisation, the protection of children, the right to object, automated decision-making, technical and organisational measures and data protection by design and default
- Controllers are responsible for ongoing monitoring of deployed AI systems and the operation of technical and organisational measures
DPC supervision
The insights in the report have been gathered by the DPC’s Technology Multinational Supervision Unit (“TMSU”). As part of the DPC’s supervisory function, the TMSU engages with large multinational technology companies, operating as a voluntary, engagement-driven “quasi-regulatory sandbox” focused on red-line issues, high risks and likely harms. The DPC can make recommendations, request to pause a launch and, where necessary, use urgency action powers.
The Supervision engagement process is usually conducted on a voluntary basis whereby controllers give the Supervisory Function a level of access to the AI product, with the knowledge that providing this access will ultimately benefit them as well as demonstrating cooperation with the DPC. At a high level, supervision involves open dialogue regarding a controller’s intended processing or the capabilities of products that will process data, questions from the DPC, recommendations where necessary and ongoing monitoring by the DPC post-launch. Notably, the DPC does not approve or state that a process, product or service is compliant with the GDPR through supervision. For engagements involving AI, a Data Protection Impact Assessment (“DPIA“), Legitimate Interests Assessment (“LIA“) or other risk assessment may be assessed by the DPC.
According to the report, the TMSU has engaged in supervising the creation, training and deployment of AI by companies, including Airbnb, Apple, DeepSeek, Google, LinkedIn, Meta, Microsoft, OpenAI, Pinterest, TikTok, X (formerly Twitter), and others.
| Approximately 180 AI products/services engaged with |
| 79% of all AI Supervision engagements between 2021 and 2025 involved generative AI |
| 59% of AI launches between 2024 and 2025 received recommendations |
| 25% of all engagements with large technology controllers in 2025 were related to AI |
| 3 median recommendations per AI engagement |
| 95% launched without delay due to DPC engagement |
Case studies
Generative AI training: Transparency and right to object to processing
In May 2024, Meta publicly announced its intention to train its large language model (“LLM“) on user personal data. The DPC’s ongoing monitoring identified confusion around the transparency notices and difficulties with the form to object to the processing of their personal data. In the view of the DPC, users struggled to understand what the personal data processing would entail and how to object to it. For example, it is reported that users had issues accessing and completing the objection form. After assessing Meta’s LIA, the DPC raised concerns about Meta’s reliance on Article 6(1)(f) GDPR. The DPC requested a voluntary pause of the proposed AI training. Meta complied with this request. In February 2025, Meta re-engaged with the DPC relying on a revised LIA and DPIA, additional de-identification and filtering measures and additional transparency over an extended period. The DPC concluded there were no grounds justifying further regulatory action at that time.
Key takeaway: Insufficient transparency notices and objection mechanisms can undermine the legitimate interests balancing test. Due diligence must be conducted to ensure that the product design, notifications and mitigation measures are sufficient to meet GDPR compliance standards.
Monitoring the mobile opt-out bug
In January 2025, the DPC’s own practice monitoring of a live chatbot identified that non-subscriber mobile users could not opt out of having their personal data used for AI training, as the opt-out mechanism was unavailable to them on mobile phone devices. This potentially affected approximately 7.7 million EEA mobile users. The controller fixed the bug by February 2025 and committed to refrain from training the AI using data collected while the opt-out was unavailable.
Key takeaway: Controllers should monitor the ongoing implementation and functioning of their AI products in the context of GDPR compliance measures put in place to ensure compliance.
Reasonable expectations
A controller sought to train generative AI on all public posts, comments and articles collected since the platform’s inception. The controller argued that the use of the personal data for the training did not constitute a new purpose, but formed part of the purpose for which it was originally collected, namely to ‘enable and improve’ their services. The DPC recommended excluding pre-2014 data from the AI training on the basis that individuals could not have reasonably expected this use of their personal data. The controller followed this recommendation and reduced the relevant period of processed data to 2014 to present.
Key takeaway: Any processing of personal data requires a lawful basis under Article 6 GDPR. The DPC takes the reasonable expectations of a data subject into account and such expectations must be assessed in light of the circumstances at the time of collection and the context in which the data is collected. Any use of historical data for AI training heightens the need for enhanced transparency.
DPC enforcement
While most engagements with the DPC conclude with recommendations, the report confirms the DPC’s readiness to urgently intervene where risks are not adequately mitigated. In August 2024, the DPC applied to the High Court under section 134 of the Data Protection Act 2018, as Twitter refused to cease processing personal data for training its Grok AI model. Twitter subsequently undertook to cease the processing and delete the affected datasets.
Key lessons from the DPC
Documentation and governance
DPC observation: Companies are expected to provide in-depth information and detailed compliance documentation. Organisations should anticipate and proactively address the DPC’s questions. Documentation should include specific implementation details and demonstrate the choices and decisions made by the controller. There should be clear analysis, design decisions should be documented and where designated, DPO involvement in creating and documenting a DPIA.
Common issues: High-level statements of compliance without supporting evidence or reasoning have led to difficulties completing engagement with the DPC before planned launch dates. Poor or unclear documentation can result in protracted engagement and can delay launches. This can raise doubts about the effectiveness and completeness of the organisation’s compliance readiness programme.
Original risk assessments, DPIAs and LIAs
DPC observation: Training any new AI model will likely require a DPIA. Since 2023, the DPC has requested monitoring reports from controllers creating and deploying LLMs, covering LLM and safeguard performance. These reports have required original risk assessments, DPIAs and LIAs (where applicable) to be re-evaluated against real-world data and to identify shortcomings and put in place new mitigation measures where necessary.
Common issues: An AI model may be trained in a compliant manner but that does not mean it has been deployed in compliance with the GDPR. Real-world data can show that measures and safeguards are inadequate or do not operate as intended.
Transparency
DPC observation: 72% of all DPC recommendations concerned transparency. It is crucial to be transparent about AI training, creation of AI models and deployment of AI. Transparency after processing of data has taken place will not relieve a controller of its obligations in this regard. Controllers have a duty to explain that the processing of personal data by AI is occurring as well as the risks in relation to this processing.
Common issues: Some controllers were reluctant to inform users about the processing of personal data by AI. Transparency notices that are difficult to find are not appropriate. Transparency information should be easily accessible and addressed to all affected individuals whose personal data may be processed, including ‘non-users’.
Legal basis
DPC observation: Concerns regarding a controller’s reliance on a legal basis are often expansive and of critical importance to a controller’s GDPR compliance. When assessing reliance on legitimate interests, the DPC examines transparency, ease of exercising rights, the stated interest, necessity, compatibility of processing with purposes of data collection, less intrusive alternatives, mitigation measures and the balancing test (i.e., whether the controller’s legitimate interest is outweighed by the rights and freedoms of the individuals concerned).
Common issues: The DPC has found that the reliance on legitimate interests as a lawful basis for processing can be undermined by inaccessible design choices such as inadequate transparency notices and inadequate objection mechanisms (including difficulties in accessing and completing an objection).
Rights and safeguards
DPC observation: Objection mechanisms should be accessible. All users should be given sufficient transparency and prior notice of personal data processing for AI training. Safeguards to protect children should be used, e.g. child-directed transparency notices. Data minimisation measures such as pseudonymisation or anonymisation, de-duplication and reduced collection periods are also recommended.
Common issues: Inaccessible objection mechanisms can interfere with users’ data subject rights. Insufficient transparency notices, which do not appropriately explain AI-related risks and do not reflect children’s differing capacities, can lead to confusion around transparency notices. Inappropriate design choices can lead to processing more personal data than necessary.
Monitoring & compliance
DPC observation: Supervision does not end once a product or feature launches. The DPC engages in ongoing monitoring of higher-risk systems and has requested reports from controllers to gather live data to evaluate the LLM performance, the performance of safeguards, including technical as well as organisational measures, the reactions of the wider public and other real-world issues that may impact on the privacy of the AI system.
Common issues: The DPC has identified its monitoring process issues, such as bugs, errors with the output of LLMs, failure to identify additional data points for exclusion from AI training and safeguards to prevent incorrect responses, as well as features that block hallucinations.
Looking forward
Agentic AI is an emerging supervisory focus. The DPC notes that it has engaged with five controllers regarding agentic AI launches in the EU. It has already issued recommendations in a number of agentic AI engagements. It consistently raises concerns regarding transparency, how the AI works and its potential impact on individuals’ rights.
The DPC expects AI technologies and use cases to continue to evolve rapidly. The report notes that engagement with AI firms provides insight, not only into products currently on the market, but also into technologies that are still emerging. It highlights developments in areas such as image and video generation capabilities and indicates that it will continue to intervene where concerns arise regarding the processing of personal data and GDPR compliance.
The DPC will continue to adapt its supervisory approach as the regulatory landscape develops. The report notes that the DPC is monitoring legislative developments, including EU simplification measures, and it will update its recommendations on AI as needed. The report also expressly notes that it does not address supervision of AI under the AI Act, focusing instead on GDPR issues arising from AI development and deployment.
The authors would like to thank Vivienne O’Keeffe for her contribution to this briefing.
