GDPR · apply · about 10 minutes

The product team wants to train on customer data

A product manager proposes training a recommendation model on three years of customer purchase history. The privacy notice says purchase data is used "to provide and improve the service". No consent was collected for anything but marketing. The data sits with a US-based ML vendor.

Say yes, no, or yes-if — and name the three things that decide it.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Identifies this as a new purpose needing its own basis, not covered by the original one Six lawful bases, no hierarchy
Runs the legitimate interests test rather than reaching for consent Legitimate interests is a test, not a label
Tests the notice against reasonable expectations — "improve the service" is thin for model training Legitimate interests is a test, not a label
Treats the US vendor as a transfer question: adequacy scope, or SCCs plus an assessment SCCs plus a look at the destination
Asks whether the vendor is a processor here, or a controller for its own training The controller is whoever decides why
Checks whether the scale and profiling trigger a DPIA before anything is built When a DPIA is mandatory

Read against Regulation (EU) 2016/679 (GDPR), Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.