The GDPR accuracy principle in generative AI

You must now demonstrate that every personal statement your generative AI system produces is accurate and current for its intended purpose, and that you can trace, correct and re-test any inaccurate output about an identifiable person without delay.

The prompt is an analysis of the GDPR accuracy principle in generative AI workflows of 2 October 2026, which argues that the European Data Protection Supervisor and the European Data Protection Board's draft guidelines treat hallucinated statements about people as accuracy failures subject to Article 5(1)(d) of the GDPR. The analysis works through a complaint filed with the Norwegian authority about a ChatGPT output that falsely attributed a serious crime to an identifiable person, arguing that a disclaimer cannot replace accuracy. In our assessment, this development means you cannot rely on statistical performance metrics or user warnings to satisfy the accuracy principle; you must instead build testable controls into each phase of your workflow—from data sourcing through training, inference and rectification—and maintain records that demonstrate compliance.

What does the accuracy principle now require in generative AI?

The GDPR's accuracy principle has always required that personal data be correct and current for their purpose. The supervisory authorities now read this requirement as covering not only the data a model was trained on, but also the statements it generates at inference. A hallucinated claim about an identifiable person—whether invented or inferred—is an accuracy failure, not a quality issue. The distinction matters: a quality problem can be flagged with a disclaimer; an accuracy problem is a breach of Article 5(1)(d). The authorities reject the argument that telling users output may be wrong discharges your duty to keep personal data accurate.

Accuracy is purpose-relative. Data are accurate when they are correct and current in relation to the specific purpose you process them for. A system can score well on statistical benchmarks and still produce a false factual claim about one person. The test unit is therefore the individual statement, not the model's average performance.

Which workflow phases carry accuracy controls?

Accuracy must be testable at four distinct points:

• Sourcing — personal data must come from reliable sources with timestamps and validation before training begins.
• Training and fine-tuning — datasets must be verified, validation and test sets must be in place, and provider assurances must be documented.
• Output at inference — the system must be monitored with human oversight to detect and flag inaccurate personal statements before they reach users.
• Rectification — inaccurate output must be traceable to its source, correctable through documented intervention, and re-tested to prevent recurrence.

Each phase requires a control, a pass criterion and a record. The records per phase make your compliance demonstrable under Article 5(2) of the GDPR.

What must you be able to demonstrate per phase?

You must be able to show:

1. Record the sources and timestamps — document which data sources fed training, when they were collected, and how they were validated before use.
2. Verify training and test datasets — maintain records of dataset composition, validation steps, and any quality assurance performed before and after training.
3. Monitor output with human review — implement detection of potentially inaccurate personal statements at inference time and document the review process.
4. Capture rectification evidence — when a user reports inaccurate output, record the prompts, context, the original statement and the correction applied.
5. Re-test after correction — verify that the corrective action prevents the same inaccuracy from recurring, and document the result.

How does rectification work when output is inaccurate?

When a person requests correction of inaccurate personal data under Article 16, you must first assess whether the claim is valid. For generative AI, this is harder than correcting a database record because personal data cannot easily be removed from a trained model. The supervisory authorities distinguish four types of request: about training data, post-training data, prompts, and outputs. Requests about outputs are more common because outputs affect people directly.

To assess a rectification request, you need reproducible evidence: the prompts used, the full context, and the output generated. Without this, you cannot determine whether the statement is inaccurate or where the error lies. Once you have evidence, correction can be applied at three layers—in retrieval systems, through model instructions, or by retraining—depending on where the inaccurate data reside. The GDPR does not prescribe which mechanism you must use; it requires only that inaccurate personal data be rectified without undue delay.

What role do verification tools play?

Verification tools do not make output accurate and do not discharge your duty under Article 5(1)(d). Their role is to implement and evidence the output-phase control. A verification layer can route a task through independent models, show the steps taken, flag disagreements and surface sources. This gives you a claim-level basis for review and a record of what was checked. The final judgement on whether a statement about a person is correct remains your professional responsibility; no tool can transfer that duty.

Automation can carry the mechanics of control—routing, checking, recording—but not the decision. Your assessment of accuracy is not something a system can discharge on your behalf.