When the GDPR applies
The GDPR applies when training data contains personal data, meaning information about an identified or identifiable person. That includes names and contact details, but also faces in photos, voices, licence plates and combinations of details that point to one person.
Legal basis and purpose
Every processing of personal data needs a legal basis, and data collected for one purpose cannot freely be reused for another. Check why the data was originally collected and whether training a model is compatible with that purpose. The decision rests with you as controller; involve your data protection officer or legal adviser.
Minimise
Keep only the personal data the model actually needs. Often you can remove or mask names, contact details and ID numbers without hurting the task. To minimise, you first have to find it. See personal data in text datasets.
Anonymised is not the same as pseudonymised
Anonymous data, where no one can be identified by any reasonably likely means, falls outside the GDPR. Pseudonymised data, where identifiers are replaced but a person can still be identified with additional information, is still personal data (GDPR Recital 26). Replacing names with codes is pseudonymisation, not anonymisation.
Special categories
Health data, biometric data used to identify people, and other special categories have stricter rules. Photos of faces are personal data when a person can be identified. They become biometric data only when processed with specific technical means that allow unique identification (Article 4(14), Recital 51), and a special category when used for that purpose (Article 9). Counting faces without identifying anyone is a different use, but the photos are still personal data.
Document it
Record sources, purposes, legal basis, what personal data was found and how it was handled. This guide is general information, not legal advice.