Compliance

GDPR compliance for AI systems isn't just a privacy policy update.

GDPR's requirements extend directly into AI system design. Article 5(1)(c)'s data minimisation principle applies to what goes into LLM prompts. Article 22 restricts automated decision-making with significant effects on individuals. Article 28 requires a signed Data Processing Agreement with every LLM vendor receiving EU personal data. Article 13 requires you to disclose AI-driven processing to users.

A privacy policy that mentions AI is not GDPR compliance. The technical controls: PII stripping before LLM calls, deletion workflows for AI-processed data, Article 22 review queues — must be implemented in the system itself. We build those controls. Your DPO reviews them. The result is a system your legal team can actually stand behind.

How we work

Tell us what you're building.

What GDPR requires from your AI system.

These are the specific GDPR obligations that AI systems processing EU personal data must address at the technical level, not just in documentation.

Lawful basis: Article 6

Every AI inference that processes personal data requires a documented lawful basis under Article 6. Consent or legitimate interest are the most common grounds. Consent must be specific, a general terms-of-service checkbox does not cover AI processing. Legitimate interest requires a balancing test documented before processing begins, not after a complaint arrives.

Data minimisation: Article 5(1)(c)

Article 5(1)(c) requires that personal data is adequate, relevant, and limited to what is necessary for the purpose. Applied to AI systems: only the data strictly necessary for the inference task should appear in LLM prompts. Names, addresses, and identifiers that are not needed for the response should be stripped before the prompt is sent.

Automated decision-making: Article 22

Article 22 restricts solely automated processing that produces decisions with significant legal or similarly significant effects on individuals. If the AI makes decisions (loan approvals, hiring recommendations, insurance pricing) individuals have the right to human review, an explanation of the logic, and the ability to contest the decision. This right cannot be contracted away.

Data subject requests: Articles 17, 18, 20

Individuals can request deletion (Article 17), restriction of processing (Article 18), and portability of their data (Article 20). For AI systems that use personal data in training or fine-tuning, you must be able to identify and remove an individual's data from those training sets when a valid deletion request is received. This is technically non-trivial. It must be designed in from the start.

DPAs with LLM providers: Article 28

Article 28 requires a Data Processing Agreement with every processor that handles EU personal data on your behalf. Every LLM provider receiving EU personal data must have a valid DPA with Standard Contractual Clauses (SCCs) covering cross-border transfers. This is not optional. Without a DPA, the transfer is unlawful regardless of encryption or security controls.

What we implement.

These are the specific technical controls we design and build for GDPR-compliant AI systems. Each maps to a specific GDPR article.

PII minimisation layer before LLM calls

A preprocessing step that detects and strips or pseudonymises personal identifiers before they reach the LLM API. Names, email addresses, phone numbers, and other Article 4(1) personal data are replaced with consistent tokens where possible so the AI task can still be completed.

Lawful basis documentation

A register of processing activities (ROPA) entry for each AI feature, documenting the purpose, lawful basis, data categories, retention period, and processor list. Required under Article 30 for organisations processing at scale. We produce the technical facts; your DPO reviews and signs off.

Article 22 human review hooks

For AI systems making automated decisions with significant effects, we build the technical infrastructure for human-in-the-loop review: a review queue, an override mechanism, an explanation log, and an audit trail of which decisions were reviewed by a human and what the outcome was.

DPA review and gap analysis for LLM vendors

We review the DPA documents for every LLM vendor in your stack, check that SCCs are in place for US transfers, and flag clauses that may conflict with your GDPR obligations, particularly around the vendor using your data for model training.

Data subject request handling for AI-processed data

Technical implementation of deletion and portability workflows for AI-processed personal data. Where personal data has been used in fine-tuning or embeddings, we implement the processes required to identify and action deletion requests, including retraining or regenerating affected embeddings.

LLM vendors with DPAs and SCCs.

Each vendor below offers a Data Processing Agreement with Standard Contractual Clauses for EU data transfers. SCCs are required under Chapter V of the GDPR for transfers to third countries (including the US). Confirm the current DPA version and scope before sending EU personal data.

Important: Consumer-tier products (ChatGPT.com, Claude.ai, Gemini.google.com) are not processor relationships under Article 28 and must not receive EU personal data in a B2B context.

OpenAI→

API tier DPA available with SCCs. Enterprise tier required for full data processing agreement. Standard ChatGPT.com is not a processor relationship.

Anthropic→

API DPA available. Enterprise tier required for SCC coverage. Confirm current DPA version before processing EU personal data.

Google Cloud→

Cloud DPA with SCCs available. Vertex AI and Cloud AI services covered. Consumer Gemini products are separate.

AWS→

AWS DPA with SCCs. Bedrock and SageMaker covered. Confirm service-specific scope in the AWS GDPR centre.

Azure→

Microsoft DPA with SCCs. Azure OpenAI Service covered under enterprise agreements.

Who this isn't for.

GDPR technical compliance work has a specific scope. We decline engagements where we can't add genuine value.

Products that process no EU personal data
GDPR applies when you process personal data of individuals in the European Union, regardless of where your company is based. If your product has no EU users and no EU data flows, GDPR does not apply. If you're unsure whether your data flows involve EU personal data, that question belongs with your legal counsel, not with us.
Teams who only want a legal opinion
We build the technical controls: PII minimisation layers, Article 22 review queues, DPA gap analysis, deletion workflows. We do not provide legal advice or issue GDPR compliance opinions. Your DPO and legal counsel determine whether the implemented controls satisfy your obligations. We give them the technical facts to make that determination.
Anyone who wants to skip the DPA step
We will not help you route EU personal data through an LLM provider without a valid DPA and SCCs in place. The transfer is unlawful without them. If a vendor you want to use does not offer a DPA, we will tell you and help you find an alternative, not help you proceed without one.

Frequently asked questions.

Does using OpenAI or Anthropic comply with GDPR?: It depends on the tier and the DPA. Both vendors offer DPAs with Standard Contractual Clauses for EU data transfers, but only on their API tiers, not consumer products. The DPA must be in place before you send EU personal data. You also need to confirm whether the vendor uses API data for model training, as that affects your Article 6 lawful basis analysis. OpenAI's API DPA confirms they do not use API data for training by default; Anthropic's enterprise DPA includes the same commitment. Read the specific DPA version you sign, not marketing summaries.
What is Article 22 and when does it apply to AI?: Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing if that decision produces a legal or similarly significant effect. It applies when: (1) the processing is solely automated with no meaningful human involvement, and (2) the decision has significant effects, typically financial decisions, hiring, insurance pricing, creditworthiness, or comparable outcomes. If both conditions are met, you must provide individuals with the right to obtain human review, to express their point of view, and to contest the decision. Advisory AI outputs that inform but do not make the decision are generally outside Article 22's scope.
How do you handle data subject deletion requests for AI training data?: This is the hardest part of GDPR for AI systems. For retrieval-augmented systems (RAG), deletion means removing the source document and regenerating the affected embeddings, typically straightforward if you maintain source document provenance. For fine-tuned models, deletion is technically very difficult: you would need to retrain or unlearn the model. We design AI systems to minimise this problem from the start, by avoiding personal data in fine-tuning sets where possible, and by designing retrieval systems with deletion-safe embedding pipelines. We document what is technically achievable and flag irreversible processing before it is designed in.
How does the EU AI Act interact with GDPR?: The EU AI Act and GDPR are complementary but distinct frameworks. GDPR governs personal data processing; the AI Act governs AI systems by risk category. High-risk AI systems under the AI Act (those listed in Annex III, including AI used in employment, credit, education, and law enforcement) must comply with both. Article 10 of the AI Act requires training data to be relevant, representative, free of errors, and complete, which overlaps with GDPR's data quality and minimisation principles. If your AI system falls under the AI Act's high-risk category, both frameworks apply simultaneously, and the technical controls we implement must satisfy both.

Ready to get started?

GDPR compliance for AI systems isn't just a privacy policy update.

What GDPR requires from your AI system.

These are the specific GDPR obligations that AI systems processing EU personal data must address at the technical level, not just in documentation.

Lawful basis: Article 6

Data minimisation: Article 5(1)(c)

Automated decision-making: Article 22

Data subject requests: Articles 17, 18, 20

DPAs with LLM providers: Article 28

What we implement.

These are the specific technical controls we design and build for GDPR-compliant AI systems. Each maps to a specific GDPR article.

PII minimisation layer before LLM calls

Lawful basis documentation

Article 22 human review hooks

DPA review and gap analysis for LLM vendors

Data subject request handling for AI-processed data

LLM vendors with DPAs and SCCs.

Important: Consumer-tier products (ChatGPT.com, Claude.ai, Gemini.google.com) are not processor relationships under Article 28 and must not receive EU personal data in a B2B context.

OpenAI→

API tier DPA available with SCCs. Enterprise tier required for full data processing agreement. Standard ChatGPT.com is not a processor relationship.

Anthropic→

API DPA available. Enterprise tier required for SCC coverage. Confirm current DPA version before processing EU personal data.

Google Cloud→

Cloud DPA with SCCs available. Vertex AI and Cloud AI services covered. Consumer Gemini products are separate.

AWS→

AWS DPA with SCCs. Bedrock and SageMaker covered. Confirm service-specific scope in the AWS GDPR centre.

Azure→

Microsoft DPA with SCCs. Azure OpenAI Service covered under enterprise agreements.

Who this isn't for.

GDPR technical compliance work has a specific scope. We decline engagements where we can't add genuine value.

Products that process no EU personal data

GDPR applies when you process personal data of individuals in the European Union, regardless of where your company is based. If your product has no EU users and no EU data flows, GDPR does not apply. If you're unsure whether your data flows involve EU personal data, that question belongs with your legal counsel, not with us.

Teams who only want a legal opinion

We build the technical controls: PII minimisation layers, Article 22 review queues, DPA gap analysis, deletion workflows. We do not provide legal advice or issue GDPR compliance opinions. Your DPO and legal counsel determine whether the implemented controls satisfy your obligations. We give them the technical facts to make that determination.

Anyone who wants to skip the DPA step

We will not help you route EU personal data through an LLM provider without a valid DPA and SCCs in place. The transfer is unlawful without them. If a vendor you want to use does not offer a DPA, we will tell you and help you find an alternative, not help you proceed without one.

Frequently asked questions.

Does using OpenAI or Anthropic comply with GDPR?

It depends on the tier and the DPA. Both vendors offer DPAs with Standard Contractual Clauses for EU data transfers, but only on their API tiers, not consumer products. The DPA must be in place before you send EU personal data. You also need to confirm whether the vendor uses API data for model training, as that affects your Article 6 lawful basis analysis. OpenAI's API DPA confirms they do not use API data for training by default; Anthropic's enterprise DPA includes the same commitment. Read the specific DPA version you sign, not marketing summaries.

What is Article 22 and when does it apply to AI?

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing if that decision produces a legal or similarly significant effect. It applies when: (1) the processing is solely automated with no meaningful human involvement, and (2) the decision has significant effects, typically financial decisions, hiring, insurance pricing, creditworthiness, or comparable outcomes. If both conditions are met, you must provide individuals with the right to obtain human review, to express their point of view, and to contest the decision. Advisory AI outputs that inform but do not make the decision are generally outside Article 22's scope.

How do you handle data subject deletion requests for AI training data?

This is the hardest part of GDPR for AI systems. For retrieval-augmented systems (RAG), deletion means removing the source document and regenerating the affected embeddings, typically straightforward if you maintain source document provenance. For fine-tuned models, deletion is technically very difficult: you would need to retrain or unlearn the model. We design AI systems to minimise this problem from the start, by avoiding personal data in fine-tuning sets where possible, and by designing retrieval systems with deletion-safe embedding pipelines. We document what is technically achievable and flag irreversible processing before it is designed in.

How does the EU AI Act interact with GDPR?

The EU AI Act and GDPR are complementary but distinct frameworks. GDPR governs personal data processing; the AI Act governs AI systems by risk category. High-risk AI systems under the AI Act (those listed in Annex III, including AI used in employment, credit, education, and law enforcement) must comply with both. Article 10 of the AI Act requires training data to be relevant, representative, free of errors, and complete, which overlaps with GDPR's data quality and minimisation principles. If your AI system falls under the AI Act's high-risk category, both frameworks apply simultaneously, and the technical controls we implement must satisfy both.