Cutting-edge technologies based on AI are pervasively widespread within contemporary societies. Many questions around social, economic and even anthropologic implications are raising. But some features of AI and algorithmic decision-making have also a direct impact on law and fundamental rights. The essay stresses the challenges that AI is throwing to legal regulation, choosing the GDPR as a paradigmatic example for verifying the suitability of the regulation in force to tackle the features above mentioned. Therefore, the essay remembers some of the cornerstones of GDPR, paying particular attention to principles of purpose limitation, data minimisation, notice and consent, sensitive data, transparency and its corollaries, explainability, and prohibition of bias, underlining the interests protected, the shortcomings of the regulation, but also suggesting some inspirations for the future legislation.