GDPR-Compliant LLM Use

GDPR-Compliant LLM Use — explained in detail

As soon as a company uses a large language model (LLM) such as ChatGPT, Claude or Gemini for business purposes and personal data flows into prompts or attached documents, the General Data Protection Regulation (GDPR) applies in full — it provides no exception for AI. GDPR-compliant LLM use means designing the processing so that all obligations under the GDPR — and, from August 2026, additionally under the EU AI Act — remain fulfillable.

Six interlocking building blocks form the core:

1. Legal basis (Art. 6 GDPR): Every processing of personal data by the LLM must have a documented legal basis — usually legitimate interest, contract performance or consent.
2. Data processing agreement (DPA, Art. 28 GDPR): If the provider processes data on your behalf, a DPA is mandatory. ChatGPT Free, Plus, Pro and Go offer no DPA and are therefore unsuitable in a professional context involving personal data. DPA-capable options include ChatGPT Team and Enterprise, Claude Team and Enterprise, Microsoft Copilot for Microsoft 365, and Google Workspace with Gemini Business+.
3. No uncontrolled personal data in prompts: Employees should not enter names, contact details, health or contract data into prompts without approval. Pseudonymization or masking significantly reduces the risk.
4. EU hosting and data residency: Third-country transfers to the USA can be secured for DPF-certified providers via the EU-US Data Privacy Framework; EU hosting options or data residency commitments further lower the risk.
5. Training opt-out: Business inputs must not flow into model training. The enterprise and API offerings of the major providers do not train on customer data by default — the opt-out status should be verified in the respective contract (DPA).
6. Transparency, data subject rights, DPIA: Transparency obligations (Art. 13/14) belong in the privacy policy; systematic evaluation may require a data protection impact assessment (Art. 35). Data subject rights such as access and erasure are technically demanding with LLMs.

Example / Practical relevance

A marketing department wants to pre-sort customer inquiries with an LLM. Instead of the free ChatGPT version, it switches to ChatGPT Enterprise, concludes the DPA under Art. 28, and activates the EU data residency option. An internal prompt policy prohibits pasting complete customer records; names are replaced with placeholders instead. The processing is added to the privacy policy, and the AI literacy proof under Art. 4 EU AI Act is documented for the team. This makes the usage robustly secured without sacrificing productivity.

Distinction from similar terms

The DPA (data processing agreement) is only one building block of GDPR-compliant LLM use, not the whole — it governs the provider’s role, not input discipline or the legal basis. Data residency describes in which region data is stored and processed and supports compliance, but is no substitute for a DPA. The EU AI Act complements the GDPR with product-related AI obligations (risk classes, AI literacy), while the GDPR governs the personal-data dimension; both apply in parallel. The CLOUD Act concerns access by US authorities and is a risk factor with US providers, not itself a compliance measure.