GDPR 2026: Changes affecting businesses
The GDPR has applied since 2018 and remains the basis for handling personal data in 2026. The use of AI brings additional transparency obligations under the AI Act for certain systems. US data transfers and security incidents each require an assessment of the specific case. Businesses should document data flows, responsibilities and reporting procedures.
Key takeaways
- AI requires a data protection review. An impact assessment is required where there is likely to be a high risk to the people concerned.
- US transfers depend on the recipient. The Data Privacy Framework covers certified US organisations.
- Assess reporting obligations separately. The GDPR and the BSI Act apply to different types of incident.
Review AI use and data protection
Anyone processing personal data with an AI tool needs an appropriate legal basis and must inform the people concerned in accordance with the GDPR. Businesses should record which data is processed for what purpose and which service providers have access.
A data protection impact assessment is required where processing is likely to result in a high risk to the rights and freedoms of natural persons. Whether this applies depends on the specific use. Article 22 of the GDPR covers decisions based solely on automated processing that have legal or similarly significant effects on a person. Specific safeguards and exceptions apply.
Since 2 August 2026, certain transparency obligations under the AI Act have also applied. Under certain conditions, these include informing a person that they are interacting with an AI system. The applicable obligation depends in part on whether the organisation acts as a provider or a deployer.
Monitor US data transfers
The adequacy decision on the EU-US Data Privacy Framework allows personal data to be transferred to US organisations certified under the framework. Before making a transfer, businesses should check whether the specific recipient and the processing concerned are covered by the certification. The other GDPR obligations continue to apply.
Where an adequacy decision does not provide an appropriate basis, standard contractual clauses are one option for providing appropriate safeguards. Businesses must assess whether the level of protection is ensured for the specific transfer and whether supplementary measures are needed. Data flows and contractual arrangements should be documented clearly.
Report personal data breaches and security incidents
A personal data breach must generally be reported to the competent data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Reporting is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where there is a high risk, the people affected may also need to be notified.
For important and particularly important entities, § 32 of the BSI Act requires an early warning within 24 hours and a further notification within 72 hours to the joint reporting office in the event of a significant security incident. The obligation applies no earlier than the establishment of the reporting channel. Whether an incident falls under both rules must be assessed separately. A shared action plan with clear responsibilities helps ensure that both assessments are initiated in time.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
Does every AI tool require a data protection impact assessment?
No. The deciding factor is whether the specific processing is likely to result in a high risk to the rights and freedoms of natural persons.
Is the Data Privacy Framework sufficient for every US service provider?
No. The specific recipient must be certified under the framework for the processing concerned. The other GDPR requirements also continue to apply.
Does every cyber incident have to be reported twice?
No. The GDPR concerns personal data breaches that must be reported. The BSI Act covers significant security incidents at the entities concerned. Both sets of conditions can apply at the same time.
Editor’s Picks
Editor’s PickNIS2 Checklist 2026: What Companies Need to Implement NowEditor’s PickAI Act 2026: What the EU AI Act Means for CybersecurityEditor’s PickMulti-Cloud Security 2026: Top 5 Risks & Mitigation
More from the MBF Media Network
cloudmagazinCloud Trends 2026: IT Decision-Makers Must TrackMyBusinessFutureAI Made in Germany: 935 Startups and a Maturing Ecosystem
