GDPR: the rules for your personal data

Personal data is anything someone can identify you by. Name and email, of course. But also where your phone is at seven every morning. From that alone you can tell where you live, where you work and who you visit after work.

The regulation says a few simple things. You need a lawful basis to collect. You have to say honestly what you do with the data. You don't keep more than you need, or longer than you need. And you have to be able to prove you do all of this, not just claim it.

An example from this autumn

On September 21, 2026 Ireland's Data Protection Commission fined Google €403 million over location data collected between May 25, 2018 and February 4, 2020. According to the decision, Google breached the lawfulness and fairness of processing, transparency, and the storage limit. The inquiry began in February 2020 after complaints from consumer organisations. The decision came six and a half years later.

Your phone's location says more about you than you would.

Why this is an AI story

Models feed on data, and agents read your email and your calendar. Every time an AI product touches personal data of people in the EU, GDPR is in the room, next to the DSA and the EU AI Act. On the same day as the fine, the European Data Protection Board (EDPB) adopted its final guidelines on how GDPR and the DSA fit together.

The clearest example is from the summer. On August 21, 2026 the Dutch data protection authority, Autoriteit Persoonsgegevens (AP), fined Uber €824,990,000. In the AP's assessment, between 2018 and 2022 Uber deactivated drivers automatically, on suspicion of fraud or over customer ratings that were too low, sometimes permanently, without a human looking at the case. That is the ban on fully automated decisions in Article 22 of the GDPR, and separately, drivers weren't informed well enough. "A computer should not make decisions on its own that have major consequences for you," says AP deputy chair Monique Verdier. Uber is contesting the fine. On October 8 the European Data Protection Board (EDPB) published the decision and noted that there is no final judicial decision yet.

The same holds when data passes through other hands. On October 2, 2026 the Norwegian authority Datatilsynet took its final decision to fine Xandr, an advertising company owned by Microsoft, €8.6 million (NOK 92 million) over data of Grindr users in Norway. Xandr relied on the consent collected by Grindr, and the authority considers that consent invalid. The EDPB summary says: "accountability cannot be outsourced". Each joint controller has to check for itself that the consent is valid and covers its own processing.

The visual is generated code-art, no third-party images.