# GDPR

> The EU's data protection law. It sets rules for how organisations collect, store, and use people's personal data, with real penalties for getting it wrong.

**Category:** Safety

**GDPR is the European Union's data protection law.** It governs how any organisation, in the EU or dealing with EU residents, may collect and use [personal data](/glossary#personal-data). Three plain ideas sit under it: have a good reason to hold data, collect only what you need, and respect people's rights over their own data.

For AI at work it matters because **what you paste into a tool may be personal data.** Know your organisation's policy before you share it. (This is general information, not legal advice.)

## At work

Before pasting a customer list into any AI tool, ask: is this personal data, and does our GDPR policy allow it? A quick check beats a breach.

## Often confused with

A blanket ban on data. GDPR does not forbid using data; it sets rules for using it responsibly and lawfully.

## Related terms

- Personal data
- Anonymisation
- Enterprise tier

## See it in a lesson

[AI at work: safety and privacy](/en/learn/foundations/ai-at-work-safety-and-privacy)

## Further reading

- [What is GDPR? (GDPR.eu)](https://gdpr.eu/what-is-gdpr/): A plain-English overview of the law.
- [General Data Protection Regulation (Wikipedia)](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation): A fuller, well-sourced reference.
- [Data protection explained (European Commission)](https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en): The rules straight from the EU.

---

Last updated: 24/07/2026  
Source: Rollo Academy glossary