AI privacy rules for businesses: a plain summary

admin
AI privacy rules for businesses: a plain summary cover graphic

Privacy law was not written with AI tools in mind, yet it governs most of what happens when staff paste customer details into a chatbot or when software scores applicants. In 2025 and 2026 several regions either added AI-specific privacy duties or started debating how existing rules apply to AI.

This article summarises the dated changes we found in public sources: California’s updated privacy regulations, the EU’s data omnibus debate, India’s new data protection rules and new US state privacy laws. It is a plain summary for business owners, not legal advice. Laws differ by place and by business, so check with a qualified adviser.

Key takeaways

  • California’s updated CCPA regulations took effect on 1 January 2026 and cover automated decision-making technology (ADMT), risk assessments and cybersecurity audits, each with its own later deadline.
  • Businesses in California that use ADMT for significant decisions must comply from 1 January 2027, with pre-use notice, an opt-out unless an exception applies, and a human review route.
  • In the EU, the Council agreed its position on the data side of the Digital Omnibus on 21 October 2026. It removed a proposal to state that AI training can rest on legitimate interest, and talks with Parliament are not expected before March 2027.
  • India’s DPDP Rules were notified on 13 November 2025, with consent manager rules after 12 months and most duties after 18 months, on 13 May 2027.
  • Whatever your location, the safest habits are the same: know what data goes into each tool, limit it, and read the vendor’s data terms.

Summary

Privacy rules reach AI in two ways. Some rules are about the data itself: what you collect, why, how long you keep it and who sees it. Others are about decisions: if software makes or heavily shapes a decision about a person, they may be owed notice, an explanation, a way to object and a human review. California’s rules now do both. The EU is still deciding how far to change its approach. India has set a phased timetable.

We read law firm and agency summaries, not the regulations themselves. Where we quote a deadline it comes from a named source in the list at the end, accessed on 11 November 2026.

California

What was approved

The California Privacy Protection Agency announced on its website that the Office of Administrative Law approved new regulations covering cybersecurity audits, risk assessments, automated decision-making technology and updates to existing CCPA rules. The agency says they are effective 1 January 2026, with some requirements phased in later.

The staggered deadlines

Topic Deadline reported Who is affected
Risk assessments Compliance begins 1 January 2026. Processing that began earlier and continues needs an assessment by 31 December 2027. Summary reporting to the agency begins 1 April 2028. Businesses doing processing that poses significant risk
ADMT for significant decisions 1 January 2027. New ADMT deployed on or after that date must comply before first use. Businesses using ADMT to make significant decisions
Cybersecurity audit certifications 1 April 2028 for revenue above $100 million, 1 April 2029 for $50 million to $100 million, 1 April 2030 below $50 million Businesses whose processing poses significant risk

What ADMT duties involve

A Thompson Coburn summary lists the main ADMT requirements as a pre-use notice, an opt-out unless an exception applies, access and explanation on request, an appeal process with human review, and a risk assessment before use. It describes the cybersecurity audit as requiring an objective, independent auditor and five-year retention of reports. We did not verify the exact definition of ADMT or the exceptions, which matter a great deal. Read the regulation text or take advice before relying on a summary.

Why it matters for tool users

If you use AI to screen job applicants, set prices for individuals, or decide on credit or services for California residents, this is the section to read first. If you only use AI to draft emails, the data-handling duties and vendor contracts are likely more relevant than ADMT.

European Union

The debate over GDPR changes

The EU’s Digital Omnibus has an AI half and a data half. The AI half, covered in our article on new AI regulation, is now law. The data half would change parts of the GDPR and is still moving through the process.

According to noyb, the European Data Protection Board and European Data Protection Supervisor published a joint opinion in February 2026. Noyb reports that the authorities strongly opposed narrowing the definition of personal data. On the proposal about AI training based on legitimate interest, noyb says the opinion did not strictly oppose it but said the new Article 88c did not clarify the matter and that companies would still need a three-step test.

The Council position of 21 October 2026

An Addleshaw Goddard briefing dated 26 October 2026 says the Council agreed its position on 21 October. According to the briefing:

  • The Commission’s proposed change to the definition of personal data was deleted. A new Article 25a on pseudonymised data was added, and the EDPB is asked for an opinion on pseudonymisation and anonymisation.
  • The Commission’s proposed amendment allowing legitimate interest as a basis for training AI models was removed. A new recital says developing or operating an AI system does not in itself constitute a legitimate interest and must be assessed case by case.
  • The European Parliament must adopt its own position first, and talks between the institutions are not expected to start before March 2027.

The briefing advises against changing internal compliance frameworks too early because the position can still change. Existing GDPR rules remain the ones that apply today.

India

A Hogan Lovells publication says India’s Digital Personal Data Protection Rules were notified on 13 November 2025, with a phased timetable.

Phase Date What applies
Immediate 13 November 2025 Scope of the Act, definitions, and the Data Protection Board and its powers
12 months 13 November 2026 Registration and obligations of consent managers
18 months 13 May 2027 Notice and consent, security safeguards, breach intimation, data retention, children’s data, significant data fiduciary duties, data principal rights and cross-border transfers

The same source says the older 2011 IT Rules stay in force until the phased implementation is complete. For businesses in India, the 13 May 2027 date is the one that covers most day-to-day duties, including how you handle personal data that goes into AI tools.

Other US states

A Hunton Andrews Kurth post dated 20 January 2026 lists Indiana, Kentucky and Rhode Island as new comprehensive consumer privacy laws that took effect on 1 January 2026. It also lists amendments to Oregon’s Consumer Privacy Act and, on the AI side, California’s Transparency in Frontier Artificial Intelligence Act. The post is a short summary that links elsewhere, so we cannot describe those laws’ provisions. A business with customers in several states should check each state’s thresholds and rights.

Dates in one table

Date Region Event
13 November 2025 India DPDP Rules notified
1 January 2026 California Updated CCPA regulations effective
1 January 2026 Indiana, Kentucky, Rhode Island New privacy laws effective
February 2026 EU EDPB and EDPS joint opinion on the Digital Omnibus
21 October 2026 EU Council position on the data omnibus
13 November 2026 India Consent manager rules begin
1 January 2027 California ADMT compliance date
March 2027 (earliest) EU Talks between institutions not expected before this
13 May 2027 India Most DPDP duties apply
31 December 2027 California Assessment deadline for earlier processing

What it means for tool buyers

Treat data in prompts as personal data

Names, emails, notes about customers and job applicant details are personal data when they are typed into an AI tool. The question for each tool is where that data goes, whether it is stored, and whether the vendor uses it to train models. Our guide on whether your AI tool is training on your data explains what to look for in the terms.

Check contracts and settings, not just features

Ask for a data processing agreement where the law expects one, check retention periods and ask whether you can switch off training on your content. How to evaluate AI tool vendors on privacy gives a question list.

Separate low-risk from high-risk uses

Drafting a blog post is different from ranking people. The rules we summarised get stricter when decisions affect individuals. Keep a short record of those uses and who reviews them. How to protect company data when using AI tools covers practical steps such as account setup and redaction.

A plain checklist

  • List every AI tool in use, including free tools staff chose themselves.
  • Note which data types go into each one.
  • Read each vendor’s data and training terms and keep a copy.
  • Decide what staff must never paste in, and write it down.
  • For tools that affect decisions about people, note who reviews the output.
  • Check dates for the regions where your customers live.
  • Review this list every quarter, because the rules and the tools both change.

What to watch next

  • Whether the European Parliament agrees with the Council on legitimate interest and AI training.
  • Further detail on California’s ADMT rules as the 1 January 2027 date nears.
  • The approach of India’s regulators once the main duties start on 13 May 2027.
  • Any further state privacy laws and amendments in the United States.

Frequently asked questions

Do privacy laws apply if I only use AI tools and do not build them?

Generally yes, because the law attaches to the personal data you handle and the decisions you make, not to who built the software. The detail depends on your location and your customers’ locations.

Can I paste customer data into a chatbot?

It depends on the tool’s terms, your own privacy notice and local law. As a safe default, avoid it unless you have checked the vendor’s data terms and have a lawful basis. Anonymise where you can.

What is ADMT?

It stands for automated decision-making technology. California’s regulations set duties for businesses that use it for significant decisions. Check the regulation’s exact definition for your use case.

Has the GDPR been changed to allow AI training?

Not as of the sources we read. The Council removed the proposed explicit allowance on 21 October 2026, and Parliament has not yet agreed its position.

Does India’s law apply to a small business?

We did not verify exemptions or thresholds. The source describes obligations phased in on 13 November 2026 and 13 May 2027. Ask an adviser about your case.

Is this legal advice?

No. It is general information as of 11 November 2026.

Conclusion

The direction is clear even if the details are still moving: more notice, more explanation and more documentation when AI touches personal data. You do not need to read every statute to act. Know your tools, limit what goes in, read vendor terms and keep records. To go further, see how to write an AI use policy for your team and how to document AI-assisted decisions. This is general information, not legal advice.

Sources

Keep reading