Module 1
What the law protects: personal data, the main roles and the seven principles
Every lawyer now handles other people’s personal data: clients, witnesses, employees, counterparties. And almost every new AI tool a lawyer might try takes that data in as its fuel. Before asking what the law says about AI, you need the foundations: what counts as personal data, who has which role, when the law applies, and the handful of principles that every later rule grows from. This module builds that base. It describes the EU General Data Protection Regulation (GDPR) and the closely similar UK regime; many other countries have laws with the same shape, but the details differ.
Hover over an idea to light up what it connects to, click it for its definition, minimum requirements, an example and the usual trap, press Play to watch the map build step by step, or trace a short case through it.
Simplified teaching map, in general terms. Check the law where you work. On a small screen, scroll the map sideways.
By the end of this module you can
- Say what counts as personal data, and what does not.
- Identify the special categories that need extra care.
- Name the roles of controller, processor and data subject in a given situation.
- Explain when the law applies outside its home territory.
- State the seven principles and apply each to a simple fact pattern.
Part 1. The lecture
What counts as personal data
The GDPR protects personal data: any information relating to an identified or identifiable living person. The test is not whether a name appears. It is whether the person could be picked out, directly or indirectly, using the information alone or together with other information that is reasonably available.
| Usually personal data | Often personal data in context | Not personal data |
|---|---|---|
| Name, home address, email address, phone number | An IP address, a cookie or device identifier, a vehicle registration | Truly anonymous statistics, from which no one can be identified |
| A photo or voice recording of a person | A job title in a small firm (“the managing partner”) | Information about a company that does not identify any individual |
| A national identity or tax number | A set of data with the name removed but a unique code kept (pseudonymised) | Data about a person who has died (in most cases; national laws may differ) |
| Health, financial and employment records about a named person | Location data from a phone | General information with no link to any person |
- Pseudonymised data (names replaced by codes, with the key kept somewhere) is still personal data, because the person can be identified again. Anonymised data, where re-identification is not reasonably possible, falls outside the law. True anonymisation is harder than it looks.
- The law covers opinions about a person (“she is a difficult client”) as well as facts, and covers both accurate and inaccurate information.
- It protects individuals, not companies. But a company’s data often contains data about individuals, such as directors, employees and contacts.
A practical test
Ask: could someone, using this information and anything else they can reasonably get, work out who it is about? If yes, treat it as personal data. When in doubt, treat it as personal data.
Special categories and criminal data
Some kinds of personal data carry more risk of harm if misused, such as discrimination. The GDPR calls them special categories and sets a higher bar for using them.
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade-union membership
- genetic data
- biometric data used to identify a person (a fingerprint or face template used for identification)
- data concerning health
- data concerning a person’s sex life or sexual orientation
Information about criminal convictions and offences is treated separately and is allowed only in limited circumstances, usually under official control or where national law provides safeguards.
Special-category data is common in legal work: medical evidence in an injury claim, trade-union membership in an employment dispute, religious details in an immigration file. It may also be inferred: a client list can reveal health or beliefs. Treat the inference as the same kind of data.
The roles: controller, processor and data subject
Almost every rule in the GDPR attaches to a role. Find the role first, and the rules follow.
| Role | Who it is | Example |
|---|---|---|
| Data subject | The living person the data is about. | A client, a witness, an employee. |
| Controller | The person or organisation that decides why and how personal data is processed. | A law firm in relation to its client files; an employer in relation to staff records. |
| Processor | A person or organisation that processes data on behalf of and on the instructions of a controller. | A cloud-storage provider, a document-review vendor, a payroll bureau. |
| Joint controllers | Two or more that decide together why and how. | Two organisations running a shared project and a shared database. |
| Recipient or third party | Someone to whom the data is disclosed. | A court, an expert witness, an insurer. |
The label in a contract does not decide the role. What matters is who actually decides the purposes and the essential means. A vendor that uses client data for its own purposes (for example, to train its own model) may be a controller for that use, whatever the contract calls it.
A law firm is usually a controller of the personal data in its client files, because it decides how to use the data to advise the client. It may also be a processor in some situations, for example where it handles data purely on the instructions of a corporate client for that client’s own purposes. Working out which is part of a lawyer’s own compliance.
When the law applies
The GDPR applies in two main situations. First, where an organisation is established in the EU and processes personal data in the context of that establishment, wherever the processing actually takes place. Second, where an organisation outside the EU offers goods or services to, or monitors the behaviour of, people in the EU.
This territorial reach means that a firm outside Europe may still be bound, for example by advertising its services to people in the EU or by tracking their behaviour online. The UK has its own version of the regime (often called the UK GDPR, together with the Data Protection Act 2018), which is very similar in structure. Many other countries have adopted laws with the same shape, but their details differ.
Why a lawyer should care about reach
A client may be bound by the law even without an office in Europe.
A transfer of data out of the EU is itself regulated (Module 5).
Fines can be large: up to 20 million euros or 4 per cent of worldwide annual turnover, whichever is higher, for the most serious breaches.
Some processing is outside the main regime: purely personal or household activity, and certain security and criminal-law enforcement activity, which have their own rules. If an issue falls into one of these, check the specific rules.
The seven principles
Seven principles run through the whole law. When you meet a new situation, including a new AI tool, ask how each one applies. Six are set out in Article 5 as principles about the data; the seventh, accountability, requires you to be able to show compliance.
| Principle | In plain words | Example question |
|---|---|---|
| Lawfulness, fairness and transparency | Have a legal basis, treat people fairly and tell them what you are doing. | Do the people know their data is going into this tool? |
| Purpose limitation | Collect data for a stated purpose and do not use it later for an incompatible one. | Was this data collected to advise the client, and are we now using it to test a product? |
| Data minimisation | Use only what is adequate, relevant and necessary. | Do we need the whole file, or only two paragraphs? |
| Accuracy | Keep it accurate and up to date. | What if the AI summary is wrong and it ends up on the file? |
| Storage limitation | Keep it no longer than necessary. | When will we delete the prompts and outputs? |
| Integrity and confidentiality (security) | Protect it against loss, misuse and unauthorised access. | Who can see what is entered, and where is it stored? |
| Accountability | Be able to show that you comply. | Where is our record of the decision to use this tool? |
These principles are not a checklist to be ticked once. They are questions that stay open for as long as the data is held. In the next modules each principle becomes a set of concrete duties: lawful bases, rights, security, records, and rules for transfers and AI.
Part 2. Lab: Is It Personal Data?
For each item, decide whether it is personal data, special-category data or neither.
Situation 1 of 8
A client’s name and home address on a letter of engagement.
Where does this belong?
Part 3. Lab: Who Is the Controller?
In each situation, decide which role the organisation described plays for the data in question.
Situation 1 of 3
A law firm uses a cloud service to store its client files. The service stores the files and does nothing else with them, following the firm’s instructions.
What is the cloud service’s role for the client files?
Part 4. Check your understanding
Ten questions drawn from a larger pool. Sign in to have your score saved towards your certificate.
You have finished the free module
Here is what you can do now, and where the course goes next
Module 1 gave you
- Say what counts as personal data, and what does not.
- Identify the special categories that need extra care.
- Name the roles of controller, processor and data subject in a given situation.
- Explain when the law applies outside its home territory.
- State the seven principles and apply each to a simple fact pattern.
Next, 6 more modules and a capstone
- Module 2: Lawful bases, consent and legitimate interestsYou will learn to list the six lawful bases and say when each fits.
- Module 3: The rights of individuals: information, access, correction, erasure and objectionYou will learn to explain what a privacy notice must tell people.
- Module 4: Security, breaches and accountability: records, impact assessments and the 72 hoursYou will learn to describe the security duty and what ‘appropriate’ means.
- Module 5: Processors, contracts and international transfersYou will learn to state what a processor contract must contain.
- Module 6: AI and personal data: training, prompts, profiling and automated decisions
- Module 7: Running privacy in a law firm, and advising clients on AI
- Capstone: Capstone: review an AI tool for a law firm, from purpose to decision
Each module has its own practice labs and a graded quiz, and a Certificate of Completion follows when you pass them all. The whole course is $15 once, or included in an All-Access Membership.
Two Ways In
Introductory PriceGDPR and AI: buy it on its own, or get it with All-Access
Unlock all of GDPR and AI on its own with a one-time purchase, or get it as part of an All-Access Membership, which also covers every course and the other paid tools. A member never needs to buy it separately.
This is an early, introductory price for a brand-new product — it’s expected to rise as we add more content. Buy now and it’s yours at today’s rate, forever.
No account needed: you pay, and we email you a one-click sign-in.
All-Access is $19.99 a month or $149 a year, and covers every course and most tools, this one included. Create a free account to subscribe.
Look first, then buy. Free previews on every product page. Secure payment by Stripe. Pay once, keep it forever. Details
See what is included in All-Access →Not ready to buy? Create a free account to save your quiz scores and your place in this course, and to get the printable reports from the practice rooms.
General education on data protection and AI for lawyers, using invented people and situations. It is not legal advice. Data protection and AI laws differ between countries and change over time: check the current law that applies to your case and the guidance of the relevant regulator.
Teaching? Share this with your class
Free to use in class. The free parts open for everyone, no account needed.