Twenty data protection authorities commit to trustworthy data governance for AI

Twenty data protection authorities (DPAs) from around the world have signed a joint statement committing to develop frameworks for artificial intelligence (AI) that are both innovative and privacy-protecting. The agreement was announced during the Global Privacy Assembly (GPA) held in Seoul from 15 to 19 September 2025.

The signatories include authorities from Australia, Belgium, Bulgaria, Canada, Croatia, Finland, France, Germany, Hong Kong, Ireland, Italy, Korea, the Netherlands, New Zealand, Luxembourg, Macao SAR, Spain, Poland, Sweden, and the United Kingdom. The statement builds on earlier work initiated in Paris in February 2025 by several of these regulators, including France’s CNIL, the UK’s ICO, and Korea’s PIPC.

The joint statement highlights the opportunities AI brings to areas such as healthcare, business, and public services, while also pointing to risks such as data misuse, discrimination, disinformation, and so-called ‘AI hallucinations.’ To address these challenges, the DPAs stressed the need for robust data governance, risk management, and the incorporation of privacy principles directly into AI design.

The agreement sets out several commitments: clarifying legal bases for data use in AI, improving security measures, monitoring the societal impact of AI, reducing legal uncertainty for innovators, and strengthening cooperation between regulators. By signing, the DPAs aim to provide clearer rules for developers and users of AI systems while ensuring that privacy and fundamental rights remain protected.

Why this matters

For civil society, this joint commitment is significant because it acknowledges that AI cannot be developed responsibly without strong protections for privacy and fairness.