GDPR Notice Requirements for AI Training Data

Scope: Understanding Your Obligations

This guide explains your responsibilities under Articles 13 and 14 of the GDPR when using personal data to train AI models. It's aimed at helping your compliance team determine whether you need to send privacy notices directly to individuals whose data is in your training sets or if public information campaigns suffice.

We focus on three scenarios:

• Data collected directly from individuals
• Data obtained from third-party sources (scraped content, purchased datasets, controller-to-controller transfers)
• Situations where direct notice is impractical or impossible

This guide isn't about whether you must disclose AI training in your privacy notice (you must). It's about how you deliver that notice to data subjects.

Key Concepts and Definitions

Direct collection: You get personal data straight from the individual (form submissions, account creation, uploaded content).

Indirect collection: You obtain personal data from sources other than the individual (web scraping, data brokers, public records, another controller's dataset).

Reasonable period: The GDPR doesn't define this precisely. Article 14(3)(a) requires notice "within a reasonable period after obtaining the personal data" for indirect collection. Context matters, a month might be reasonable for batch processing but not if you're making automated decisions that affect individuals immediately.

Disproportionate effort: An exception under Article 14(5)(b) that excuses direct notice when the cost or difficulty of reaching individuals would be excessive relative to your processing purpose. You still must make information publicly available.

Impossibility: Another Article 14(5)(b) exception. If you genuinely cannot identify or contact individuals (anonymized sources, massive scale with no contact details), you're excused from direct notice but must take "appropriate measures" to protect rights.

Requirements Breakdown

Article 13(1), Direct Collection

When you collect personal data directly from individuals, provide your privacy notice "at the time when personal data are obtained."

There's no flexibility here. If someone submits a form, creates an account, or uploads content to your platform, they get the notice immediately. If you later decide to use that data for AI training, your existing notice must already cover that purpose, or you need explicit consent for the new purpose.

Article 14(3)(a), Indirect Collection, Standard Timeline

For data obtained from third parties, you have "a reasonable period" to provide notice. The regulation offers guidance on outer limits:

• Within one month of obtaining the data, or
• If you'll communicate with the individual anyway, at the time of first communication, or
• If you'll disclose the data to another recipient, before that first disclosure

Article 14(5), Exceptions to Direct Notice

You're excused from providing individual notice when:

1. The data subject already has the information (Article 14(5)(a)). If your privacy practices are already known to the individual through prior notice, you don't need to send another one. Be prepared to prove they received and could access the earlier version.

2. Providing notice proves impossible (Article 14(5)(b)). You must demonstrate genuine impossibility, not mere inconvenience. The Garante Per La Protezione Dei Dati Personali enforcement shows what regulators expect: a "non-marketing oriented information campaign" across "all the main mass media channels (including radio, television, newspapers and the Internet)."

3. Providing notice would involve disproportionate effort (Article 14(5)(b)). This isn't a cost-saving loophole. The same Garante case shows that even large-scale public campaigns don't necessarily qualify as disproportionate effort.

4. EU law imposes secrecy obligations (Article 14(5)(d)). Rare in AI training contexts unless you're processing data under national security or law enforcement mandates.

Implementation Guidance

For direct collection scenarios:

Configure your data intake points (forms, APIs, upload interfaces) to present privacy information before or during collection. Don't rely on a privacy notice buried in footer links. If you're repurposing existing data for AI training, treat it as a new processing purpose requiring fresh legal basis.

For indirect collection scenarios:

Document your reasonable-period calculation. Consider:

• Volume of records (10,000 vs. 10 million affects feasibility)
• Availability of contact information
• Urgency of the processing
• Whether you'll interact with individuals soon anyway

If you're scraping public websites, you likely lack direct contact details. Start evaluating impossibility or disproportionate effort immediately.

For public information campaigns:

The Garante enforcement establishes a floor, not a ceiling. Your campaign should:

• Run across multiple media channels relevant to your data subject population
• Clearly explain what data you're processing and for what AI training purpose
• Direct individuals to your full privacy notice
• Provide accessible mechanisms for rights requests
• Be genuinely informative, not promotional

Budget for this. The supervisory authority explicitly required a "non-marketing oriented" approach, which means you can't fold compliance messaging into product advertising.

Common Pitfalls

Claiming disproportionate effort too quickly: Regulators interpret this exception narrowly. If a supervisory authority required a multi-channel media campaign in one case, your argument that sending emails would be too burdensome won't hold.

Confusing "reasonable period" with "whenever we get around to it": One month is a guideline, not a guarantee. If you're making automated decisions that affect individuals, your reasonable period shrinks.

Treating "already has the information" as blanket coverage: This exception requires that individuals actually received notice about this specific processing. A generic privacy notice from 2019 that mentions "product improvement" doesn't cover AI model training you started in 2024.

Assuming web scraping equals impossibility: Just because you scraped data doesn't automatically make direct notice impossible. If the scraped content includes email addresses or usernames you could contact, you haven't met the impossibility threshold.

Skipping the public measures when you claim an exception: Articles 14(5)(b) and 14(5)(c) aren't get-out-of-jail-free cards. You must still "take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available."

Quick Reference Table

Collection Type	Notice Timing	Exceptions Available	Required Alternatives
Direct from individuals	At time of collection	Already has information; EU secrecy law	None, must provide notice or qualify for narrow exception
Indirect (third-party)	Within reasonable period (≤1 month guideline)	Already has information; impossibility; disproportionate effort; EU secrecy law	Public information availability; appropriate measures to protect rights
Scraped/public sources	Within reasonable period	Impossibility; disproportionate effort (if no contact details)	Public information campaign across relevant media channels; accessible privacy notice

Key Article References:

• Article 13(1): Direct collection notice requirement
• Article 14(3)(a): Indirect collection timing
• Article 14(5)(a)-(d): Exceptions to individual notice
• EDPB-EDPS Joint Opinion 5/2021, para. 60: AI training disclosure requirement

When you claim an exception, document your reasoning thoroughly. Supervisory authorities review these decisions during audits and investigations, and the burden of proof sits with you.