Trust

GDPR and EU data residency.

GDPR does not prohibit AI. It requires you to know what personal data goes where, on what basis, and to be able to honour a subject's rights afterwards — which is where LLM systems get interesting.

Last reviewed 4 September 2026 · Engineering guidance, not legal advice.

A NOTE ON THIS PAGE

SCOPE AND LIMITS

This is an engineering summary of how GDPR obligations shape the design of an AI system, not legal advice. Lawful basis, transfer mechanisms and the processor question depend on your specific configuration and contracts. Treat it as a guide to what to ask your counsel and your DPO, and check the date above.

THE FOUR QUESTIONS

1. What personal data enters the system, and does it need to? The most effective compliance measure is also the cheapest: send less. Most prompts carry a full record where three fields would do. Minimisation is a design decision, and it is far easier to make at the start.

2. Who processes it? A hosted model provider is normally a processor and should appear in your records of processing and your DPA chain; we recommend naming it in your privacy notice rather than relying on "we use AI".

3. Where does it go? If processing occurs outside the EEA you need a transfer mechanism. The simpler path is usually not to transfer: EU-region endpoints from the major providers, or self-hosted open models, both keep the data inside the boundary.

4. Can you honour a deletion request? This is where LLM systems commonly fail. Deleting a source record is straightforward. Deleting it from a vector index, a cached context, a conversation log and an evaluation set requires those to have been designed for it — and retrofitting is painful.

WHAT WE BUILD IN

Deletion that propagates

A subject-deletion request is designed to remove the source record, its derived embeddings, cached contexts and log entries. Achievable only if every derived artefact carries a subject reference from the beginning — so we design for it before it is asked for.

Regional pinning

EU regions for compute, storage and model endpoints, verified in configuration rather than assumed from a provider's marketing page. Where the requirement is absolute, open-weight models inside your own perimeter remove the question.

Retention that actually expires

Conversation logs and traces are enormously useful for debugging and enormously risky as an unbounded personal-data store. Retention periods are set per data class and enforced by a job, not by intention.

Minimisation at the prompt boundary

Field-level selection of what reaches the model, plus redaction where the task permits. The prompt-assembly layer is the correct place for this control, because it is the last point before data leaves your systems.

QUESTIONS

QUESTIONS — 4

Yes, with an appropriate transfer mechanism — the EU-US Data Privacy Framework where the provider is certified (in force at the time of writing, though subject to ongoing legal challenge), or standard contractual clauses with a transfer impact assessment. Many organisations prefer to avoid the question entirely by using EU-region endpoints, which most major providers now offer on at least one path. That is usually less work than defending a transfer.

It is a significant one, which is why the enterprise API paths of the major providers exclude it at the time of writing, and why we configure zero retention explicitly and confirm the provider's current terms per engagement. If personal data were absorbed into model weights, deletion becomes effectively impossible — there is no reliable way to remove a person from a trained model. Confirm the specific configuration rather than relying on a general policy statement.

The same bases as any processing — usually legitimate interests or contractual necessity for internal operational systems. Using a model does not create a new category. What it does add is the transparency obligation: your privacy notice should reflect that automated processing occurs and name the processors involved. Where a decision has legal or similarly significant effects, Article 22 brings additional requirements around human involvement.

Design for it: store conversations with a subject identifier so they are retrievable and deletable as a set. Systems that log to unstructured files with no subject linkage cannot answer an SAR without a manual search, which is both expensive and unreliable. This is a one-line decision at build time and a project to retrofit.

Keep reading

Secure Data Pipelines

→

30-minute technical call · no deck