AI Officer and DPO * EFDPO - European Federation of Data Protection Officers

AI use has grown quickly from limited awareness to an everyday tool used by millions at work, school, and for information searches. About 16% of the world’s population uses AI in 2025, and roughly one in five companies is actively deploying AI, with the share increasing. The global AI market is valued around $390 billion and is growing by tens of percent annually. AI tools, especially large language models, rely on existing regulation but create new realities for data protection. They enable faster and more complex processing, can find connections and re-identify individuals from seemingly anonymized data, and can both improve cybersecurity and make sophisticated attacks more accessible. Organizations should assess impacts on data handling, protection, and compliance obligations when deploying AI.

"We are living through a genuine artificial intelligence boom. This is not merely a buzzword, but an accurate description of reality. In just a few years, AI has moved from a barely used and largely unknown technology to the general public to an everyday tool that millions of people encounter daily: at work, at school, in personal activities and when searching for information."

"From a data protection perspective, it is important to note that AI tools, large language models in particular, require existing regulation to be applied to a fundamentally new reality. AI tools enable faster and more complex data processing, are better at finding connections and re-identifying seemingly anonymised individuals and can both strengthen and automate cybersecurity while simultaneously making sophisticated attack methods more accessible."

"When deploying any AI tool or component, every organisation should therefore assess the impact that tool will have on how data is used and protected, and on compliance with the related legal and regulatory obligations."

"The AI Act sets out a comprehensive regulatory framework governing the development and use of AI, the risk classification of specific use cases, and the obligations of the parties involved."

Read at EFDPO - European Federation of Data Protection Officers