The GDPR playbook for AI training data in Europe

1. Transfers to the US are workable today. The EU-US Data Privacy Framework (DPF) is in force. A challenge was dismissed by the EU General Court in September 2025 and an appeal (C-703/25 P) is pending. If the buyer is not DPF-certified, the 2021 Standard Contractual Clauses plus a transfer impact assessment are the usual route.
2. Labs must check where training data came from. The European Data Protection Board (EDPB) says a company deploying a model should assess whether it was built with unlawfully processed personal data, including the data's source. Per-clip consent records make that check easy.
3. People can withdraw consent at any time. Their clips must then be deleted and every recipient told. Nobody can honestly promise that an already-trained model "forgets", so contracts should say what does happen.
4. Ordinary video is not automatically biometric data. It becomes special-category data when it is processed to identify someone uniquely, or when it reveals sensitive facts. Plan for the stricter rules anyway.
5. Employees are the hard case. Regulators doubt employees can consent freely to their employer. Self-employed people and business owners filming their own work are the simpler start.
6. Spain adds workplace rules: no recording in rest areas, limits on audio, written information to workers and their representatives, and separate consent for use of a person's image.
7. The AI Act wants documented data: general-purpose model providers must publish a summary of training content, and high-risk systems need data-governance records.
8. Blurred video is still personal data. Redaction reduces risk; it does not make first-person video anonymous.

Sources for each point are in the sections below.

Every use of personal data needs one of six lawful bases in Article 6. For filming identifiable people at work so the footage can be licensed to AI labs, two are realistic: consent (Art 6(1)(a)) and legitimate interest (Art 6(1)(f)).

Legitimate interest needs a three-step test: a real and clearly stated interest, processing that is genuinely necessary, and a balancing test that the person's rights do not override. People's reasonable expectations weigh heavily. Most workers do not expect a recording of their working day to be licensed to AI companies, so for the people wearing the camera this test is hard to pass.

Consent must be freely given, specific, informed and unambiguous. It must be provable, and withdrawing it must be as easy as giving it (Art 7). It must not be bundled into an employment contract, and it should be granular: separate choices for filming, voice, an unblurred face, training use and transfer abroad.

Our approach: consent from every person filmed, collected by Sicreto directly. Legitimate interest is used only for narrow side tasks such as blurring people who wander into frame. A proposal to add an AI-specific legitimate-interest rule (the "Digital Omnibus", proposed new Art 88c) is not law; the Council reportedly agreed its position on 21 October 2026 and the Parliament has not.

GDPR Art 4(11), 6, 7 and Recital 43: EUR-Lex · EDPB Opinion 28/2024 on AI models: edpb.europa.eu · EDPB Guidelines 1/2024 on legitimate interest (v1.0): PDF · EDPB Guidelines 05/2020 on consent: edpb.europa.eu · EDPB-EDPS Joint Opinion on the Digital Omnibus (Feb 2026): PDF · Council position (21 Oct 2026): consilium.europa.eu

Biometric data is the result of "specific technical processing" of someone's physical or behavioural features that allows them to be uniquely identified (Art 4(14)). Article 9 restricts processing it for the purpose of uniquely identifying a person.

The EDPB's video guidelines are clear: footage of a person is not, by itself, biometric data under Article 9 unless it is specifically technically processed to help identify that person. A head-mounted camera filming hands and tools is, on its face, ordinary personal data.

Two things can change that. First, what happens downstream: running face, voice or gait recognition on the footage. Second, what the footage reveals: the Court of Justice has held that data which indirectly reveals sensitive facts, such as health or religion, can be special-category data.

What to do: ask for explicit consent as a precaution (Art 9(2)(a)), blur faces and identifying details, keep audio off by default, and ban biometric identification and emotion recognition in every licence.

GDPR Art 4(14), 9, Recital 51: EUR-Lex · EDPB Guidelines 3/2019 on video devices, paras 74-76: edpb.europa.eu · CJEU C-184/20 (OT): curia.europa.eu

People filmed must receive an Article 13 notice before capture: who the controller is, its EU representative, purposes and lawful basis, who receives the data (including AI labs abroad), how transfers are protected, how long data is kept, their rights, how to withdraw, and how to complain to the data protection authority.

People caught in frame who did not sign anything are covered by Article 14. In practice: signs at every entrance to the filming area (a short first layer), a full notice online (the second layer), and blurring or deleting anyone who has not consented.

GDPR Art 13, 14: EUR-Lex · Layered notices for video: EDPB Guidelines 3/2019, section 7: edpb.europa.eu · Templates: Art 13 notice, signage text

Consent can be withdrawn at any time. Processing before withdrawal stays lawful. After withdrawal, data held on that basis must be erased (Art 17(1)(b)) and every recipient must be told (Art 19).

What about a model already trained on the clip? The EDPB says AI models trained on personal data cannot always be treated as anonymous; it is assessed case by case. So no supplier can honestly promise that a trained model "forgets" someone.

What a contract can promise, and what we build around:

• every clip carries an ID linked to a pseudonymous wearer ID, so one person's clips can be found;
• withdrawn clips are deleted from the supplier's store and from every licensee's copies within a fixed period, with written certification;
• withdrawn clips are excluded from all future training;
• the consent form tells the worker plainly what withdrawal can and cannot undo.

Some US data releases are written as "perpetual and irrevocable". That wording sits uneasily with GDPR consent, which a person can always withdraw. Lab counsel should check it.

GDPR Art 7(3), 17, 19: EUR-Lex · Model anonymity: EDPB Opinion 28/2024, section 3.2: edpb.europa.eu

The controller decides why and how data is processed. A processor acts only on the controller's instructions under an Article 28 contract (for example, a cloud host or a blurring vendor). Joint controllers decide together and need an Article 26 arrangement.

A typical structure: the supplier who films is the controller for capture. The lab is an independent controller for its own training, under controller-to-controller data-sharing terms. If the lab dictates the capture protocol and its purposes, it may become a joint controller, which needs an Article 26 arrangement. This is a question for counsel on each deal.

GDPR Art 4(7)-(8), 26, 28: EUR-Lex · EDPB Guidelines 07/2020 on controller and processor: edpb.europa.eu · Template: controller-to-controller terms outline

• DPIA (Art 35). Spain's data protection authority (AEPD) says a data protection impact assessment is needed in most cases where two or more of the criteria on its list apply. These include new technologies, possible biometric data, large scale and combining datasets. Head-mounted capture for AI usually meets more than one, so plan a DPIA before the first shoot.
• Records of processing (Art 30). Write down what is processed, why, for how long, who receives it and how it is protected.
• EU representative (Art 27). A company outside the EU that is subject to GDPR must usually name a representative in an EU country where the people are. The Dutch authority fined Clearview AI partly for not having one.
• Data protection officer (Art 37). Required where core activities involve large-scale special-category data. Decide this with counsel.

GDPR Art 27, 30, 35-37: EUR-Lex · AEPD Art 35(4) list: aepd.es (PDF) · Clearview AI fine: autoriteitpersoonsgegevens.nl · Template: DPIA outline

1. Check whether it is a "transfer". The EDPB uses three tests: the sender is subject to GDPR, it makes data available to another party, and that party is outside the EU/EEA.
2. Data Privacy Framework. If the US recipient is on the official DPF list for the right kind of data, the adequacy decision covers the transfer. The decision is in force; the appeal against the September 2025 judgment is pending. Contracts should switch automatically to SCCs if the DPF falls.
3. Standard Contractual Clauses (2021). Module 1 for controller-to-controller, Module 2 for controller-to-processor. Note a limit: the European Commission says these SCCs do not work where the recipient's processing is itself subject to GDPR. A new set for that case has not yet been adopted.
4. Transfer impact assessment. With SCCs, assess the destination country's law and add supplementary measures where needed (EDPB Recommendations 01/2020).
5. Derogations (Art 49) such as one-off consent to a transfer are for occasional cases, not a recurring data business.

Fines are real: the Dutch authority fined Uber €290 million in 2024 over driver data sent to the US without a valid transfer tool (Uber appealed).

DPF decision (EU) 2023/1795: EUR-Lex · Appeal C-703/25 P: EUR-Lex · DPF list: dataprivacyframework.gov · SCCs (EU) 2021/914: EUR-Lex · Commission SCC Q&A (Q23-24): commission.europa.eu · EDPB Guidelines 05/2021 (transfers): PDF · EDPB Recommendations 01/2020: edpb.europa.eu · Uber fine: autoriteitpersoonsgegevens.nl · Template: transfer checklist

• LOPDGDD art 89: when employers use cameras to control work, they must first inform workers and, where applicable, their representatives, clearly and expressly. No recording in rest areas, changing rooms, toilets, dining areas or similar. Sound recording only where there are relevant security risks. The article targets employer monitoring, but a filming day hosted by an employer may be read the same way, so plan as if it applies.
• LOPDGDD art 87 and 91: privacy in workplace digital devices, and collective agreements that can add guarantees. Check the applicable convenio colectivo.
• Estatuto de los Trabajadores art 64: the works council (comité de empresa) has information and consultation rights, including on systems for organising and controlling work. Inform representatives in writing before any filming day.
• LO 1/1982: using a person's image needs their express consent, which they can revoke. That is a separate image-rights consent, on top of GDPR.
• AEPD guidance on AI (2020, plus 2026 notes on agentic AI and on data quality) and its DPIA list.

LOPDGDD: BOE · Estatuto de los Trabajadores: BOE · LO 1/1982: BOE · AEPD, GDPR and AI (2020): PDF · AEPD, agentic AI (2026): PDF · AEPD, data quality in AI (2026): PDF

• General-purpose AI models (Art 53(1)(d)): providers must publish a summary of training content using the Commission's template, published 24 July 2025. Obligations apply from 2 August 2025.
• High-risk systems (Art 10): training data needs data-governance records covering collection processes, origin, preparation and bias checks. After the 2026 AI Omnibus, the obligations for Annex III systems apply from 2 December 2027, as reported.
• Prohibited since 2 February 2025 (Art 5): among others, emotion recognition in the workplace and untargeted scraping of facial images. Licences should exclude both.

A per-batch data card covering source, method, consent basis, country and processing steps answers most of these questions directly.

AI Act (EU) 2024/1689: EUR-Lex · Training-content template: digital-strategy.ec.europa.eu · AI Omnibus dates (reported): Freshfields

• GDPR still applies to any personal data inside records: employee names, customer details, signatures, free-text notes. Remove or pseudonymise it before anything leaves your systems, and remember that pseudonymised data is still personal data.
• Anonymisation is a high bar. The EDPB's draft anonymisation guidelines (open for comment until 30 October 2026) test three things: no singling out of a record, no linking, no inference. Older guidance (WP29 Opinion 05/2014) uses the same three risks.
• Data Act (applies from 12 September 2025): its access rights cover data from connected products, not ordinary business documents, but its rules on unfair terms can affect business-to-business data contracts.
• Data Governance Act: services that put data holders in commercial contact with data users can be "data intermediation services" with notification and neutrality duties. How a data business is structured matters.
• Database and other rights: the EU database right protects substantial investment in a database, but only for makers with an EU nationality, residence or company base. Copyright and trade secrets also travel with company documents, so the right to license them needs checking.
• Security or CCTV footage is out. Sicreto does not list, export or license existing security footage, with or without consent or blurring.

Data Act (EU) 2023/2854: EUR-Lex · Data Governance Act (EU) 2022/868: EUR-Lex · EU register of data intermediation services: digital-strategy.ec.europa.eu · Database Directive 96/9/EC: EUR-Lex · EDPB Guidelines 02/2026 on anonymisation (consultation draft): PDF · EDPB Guidelines 01/2025 on pseudonymisation: PDF · WP29 Opinion 05/2014: PDF

1. Per-clip proof of the lawful basis: consent form version, choices made, date, and withdrawal status.
2. Who the controller is, its EU representative, and whether a DPIA was done.
3. The transfer mechanism (DPF check or SCC module), with a fallback.
4. The redaction standard, and when raw footage is deleted.
5. The withdrawal workflow: how fast, how it reaches you, what you must delete.
6. A licence, not an assignment, with a defined field of use, no re-identification and no biometric identification.
7. A data card per batch for your AI Act documentation.

See how Sicreto's compliance pack works Request EU data

• A written site agreement naming areas, dates and tasks, and banning any use of footage to monitor staff.
• Worker representatives informed in writing. No pressure on anyone, and no one is told who declined.
• No filming in private areas, no minors, audio off by default, and signs at entrances.
• Company records (SOPs, workflows, logs): case-by-case review only. Nothing is shared or licensed at this stage.

Start supplier onboarding Company Filming Readiness Check

• You can say no. Saying no must have no effect on your pay, shifts or job.
• You choose separately: being filmed, your voice, your face unblurred, use for AI training, transfer abroad, and use of your image.
• You can withdraw at any time, for free. Your clips are then deleted and buyers are told to delete them. No one can promise that a model already trained will forget; withdrawal stops all future use and training.
• You can complain to the data protection authority (in Spain, the AEPD at aepd.es).

Workplace Consent Checker

• License existing security or CCTV footage.
• Film minors, or film in toilets, changing rooms or rest areas.
• Deliver unblurred faces or audio unless the person chose that, clip by clip.
• Allow biometric identification, emotion recognition or worker monitoring by any buyer.
• Promise that a trained model will forget withdrawn data.
• Call blurred video "anonymous".