EDPB Opinion 28/2024, para 129: the next party must check where the data came from (EDPB Opinion 28/2024, adopted 17 December 2024, para 129)
A buyer is expected to check the source of its training data. A holder that can hand over its assessment, notices and a de-identification report makes that check easy and makes the lot easier to buy.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Such evaluation by SAs should take into account whether the controller has assessed some non-exhaustive criteria, such as the source of the data and whether the AI model is the result of an infringement of the GDPR, particularly if it was determined by a SA or a court, so that the controller deploying the model could not ignore that the initial processing was unlawful.”
Where it was read
Also read from the same source
- EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented (EDPB Opinion 28/2024, adopted 17 December 2024, para 66)
- EDPB Opinion 28/2024, para 92: a privacy notice is not enough to create expectations (EDPB Opinion 28/2024, adopted 17 December 2024, para 92)
- EDPB Opinion 28/2024, para 101: masking and substituting personal data (EDPB Opinion 28/2024, adopted 17 December 2024, para 101(c))
- EDPB Opinion 28/2024, para 102: a waiting period and an unconditional opt-out (EDPB Opinion 28/2024, adopted 17 December 2024, para 102(a)-(b))
- EDPB Opinion 28/2024, para 114: corrective measures can reach the whole dataset (EDPB Opinion 28/2024, adopted 17 December 2024, para 114)
- EDPB Opinion 28/2024, para 134: a claim of anonymity must be shown (EDPB Opinion 28/2024, adopted 17 December 2024, para 134)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide