Quick Answer

IDEA — awaiting write. Anchor: The Digital Omnibus proposes explicitly recognizing legitimate interest as a lawful basis for processing personal data for AI training and operation under the GDPR, without requiring a full balancing test. However, this is a proposal — not yet adopted. Until formal adoption, companies must still conduct a legitimate interest assessment per Article 6(1)(f) and document it. The EDPB has also clarified that large language models rarely achieve anonymization standards, so controllers deploying third-party LLMs must conduct comprehensive DPIAs.