Quarterly Privacy Update | Q3 2025

EU

CNIL Issues Several Guidelines on the Interplay of GDPR and AI Development

The French data protection authority ("CNIL") has issued several guidelines, each clarifying different aspects of how the GDPR applies to AI development. CNIL issued guidance on how to qualify AI system providers as controllers, joint controllers, or processors when creating training datasets with personal data. The guidelines provide helpful examples to illustrate cases that fall into each of the above categories.

CNIL also published additional guidelines on the use of legitimate interest as a legal basis for AI development. Following the EDPB's recognition of legitimate interest as an acceptable legal basis for processing personal data when building an AI model, CNIL released new guidelines clarifying that legitimate interest can be used as a legal basis for processing personal data in AI projects, provided that strong safeguards are implemented, and offers examples how several