'We train on user data' — one sentence most startups drop without friction. In 2026 it opens a GDPR door. Here's the concrete checklist.
Reviewed by:Dezső Mező· Founder · Engineer, DField Solutions· 05 Mar 2026
Most AI-first SaaS have the same temptation: 'we'll train on user data, because that makes the product better.' Legally this is never obvious — in 2026, GDPR and the AI Act both apply.
Under GDPR, users have a right to erasure. If personal data is baked into a model, in theory it has to be removable. In practice you can't extract it — that's the right-to-be-forgotten vs. machine unlearning tension the EU started taking seriously in 2026.
If you're doing RAG and user documents only flow into prompts (not into training), compliance is dramatically simpler. That's why we bias ~80% of projects toward RAG over training.
Stronger DPA enforcement, bigger fines, and real progress on machine unlearning. Our take: every model pipeline should ship with a consent flag and an opt-out retraining cycle. Retrofitting is brutal.
Training on user data isn't banned, but cutting corners is expensive. If it helps, we'll take your pipeline apart with you in half a day — compliance risk map plus a concrete fix list.
By
Founder, DField Solutions
I've shipped production products from fintech to creator-tooling — for startups and enterprises, from Budapest to San Francisco.
Keep reading