Large Language Models (LLM) GDPR Compliance

Summary

Organisations that train, fine-tune or use a large language model on personal data must comply with the GDPR. That means a lawful basis under Article 6, clear information for individuals, data minimisation, a DPIA where risk is high, and a way to handle data subject rights. The EDPB says a model is anonymous only if extracting personal data from it is insignificantly likely.

This guide covers when the GDPR applies to an LLM, lawful basis, unlawfully trained models, data subject rights, DPIAs, private and public deployments, transfers, the AI Act and the UK position. It applies to the GDPR, and the UK GDPR follows the same core principles.

Key Takeaways

• An LLM can fall under the GDPR at several points: training data, prompts, outputs and logs. The EDPB’s Opinion 28/2024 says anonymity must be shown case by case, so you can’t assume a model trained on personal data is anonymous.

• Legitimate interests are the usual basis for training, and it has to pass a documented three-step test covering the interest, necessity and balancing. The EDPB says people’s reasonable expectations are part of the balance, and that mitigating measures can help.

• Data subject rights, DPIAs and supplier contracts need planning before launch. Erasure and correction are hard to apply inside a trained model, so controls on inputs, outputs and logs matter.

The GDPR Applies When an LLM Processes Personal Data

Personal data is any information relating to an identified or identifiable person (Article 4(1)). An LLM touches it in four places:

• the datasets used to train and fine-tune the model;

• the prompts and files that users submit;

• the outputs the model generates; and

• the logs and feedback data the provider or deployer keeps.

Training sets built from web scraping, public datasets, or user conversations often contain names, contact details, and other identifiers; an organisation decides why and how it processes that data, and as the controller, it carries the Article 5 duties.

Your role depends on what you do with the model. A company that trains its own model controls the training data. A company that sends customer data to a vendor’s API remains the controller for that data, and the vendor may be a processor or a separate controller, depending on its terms. Our guide to controllers and processors explains how to tell them apart.

A Model Is Anonymous Only If Extraction Is Insignificantly Likely

The EDPB adopted Opinion 28/2024 on 17 December 2024, at the request of the Irish Data Protection Commission. It says the EDPB must assess, on a case-by-case basis, whether an AI model is anonymous.

A model can be treated as anonymous only if two things are insignificant: the likelihood of extracting personal data about training individuals from the model, directly or probabilistically, and the likelihood of obtaining that data through queries. The test follows Recital 26, which considers all means reasonably likely to be used.

The Court of Justice added context in its 4 September 2025 judgment in Case C-413/23 P (EDPS v SRB), listed in the Official Journal notice. The Court confirmed a contextual approach: pseudonymised data may not be personal data for a recipient that cannot reasonably re-identify people. The controller’s duty to inform people at the point of collection still applies.

For LLMs, this means a vendor’s claim that its model contains no personal data needs evidence. Ask for testing results on memorisation and extraction, and record them in your assessment.

Training and Deployment Each Need a Lawful Basis

Every processing purpose needs an Article 6 basis. If the data includes special category data, such as health information, you also need an Article 9 condition.

Consent rarely works for training on scraped or public data because it must be freely given, specific, informed, and unambiguous, and you can’t collect it after the fact. That leaves legitimate interests under Article 6(1)(f) for most training. Contract or consent can fit deployments where a user chooses to use a tool.

The EDPB says there is no hierarchy between the Article 6 bases, and the controller must choose the right one and show why. For legitimate interests, that means a three-step test:

• the interest is lawful, clearly and precisely articulated, and real and present, not speculative;

• the processing is necessary to pursue it, and there is no less intrusive way of doing so; and

• the interests, rights and freedoms of the people affected do not override the interest.

The balancing step looks at what people reasonably expect. The EDPB lists the context it considers: whether the data was publicly available, the source and its privacy settings, the nature of the service, the model’s possible further uses, and whether people know their data is online at all.

Mitigating measures can help where the balance is close. The EDPB’s examples include pseudonymisation, replacing names and email addresses in the training set with fake ones, an unconditional opt-out from the start, and respecting robots.txt or ai.txt files when scraping. Measures that the GDPR already requires do not count as extra mitigation. Our guide to data minimisation covers filtering and redaction in more detail.

Unlawful Training Can Affect Later Use of the Model

Opinion 28/2024 also considers what happens when a model was developed using unlawfully processed personal data. It covers three scenarios.

• Same controller: where personal data is retained in the model, and the same controller deploys it, whether development and deployment are separate purposes, and how far the missing legal basis affects the later processing, depends on the case.

• Different controller: where another controller deploys the model, supervisory authorities should consider whether it assessed, as part of its accountability duties, that the model was not developed by unlawful processing. That assessment looks at the data source and whether an authority or court found an infringement.

• Anonymised model: if the model is anonymised before deployment and its later operation does not involve personal data, the EDPB says the GDPR does not apply to that operation and the earlier unlawfulness should not affect it. Personal data collected during deployment is still covered.

The practical point for a buyer is due diligence. Ask the provider how it sourced the training data, which legal basis it relied on, and what evidence supports any anonymity claim.

Data Subject Rights Are Hard to Apply Inside a Trained Model

Articles 15 to 22 give people the right to access, rectification, erasure, restriction, portability and objection, and rights relating to automated decisions. These rights apply to personal data in training sets, prompts, outputs and logs.

Applying them is harder than with a database. Personal data can be memorised in model weights, an LLM can produce different answers to the same query, and removing one person’s information may need unlearning techniques or retraining.

The options organisations use in practice are:

• keeping prompts, logs and fine-tuning sets separate from the base model so they can be searched and deleted;

• filtering outputs so that a person who has made a valid request is not named;

• retraining or targeted unlearning where the risk justifies the cost; and

• a documented process for requests, with a named owner.

The GDPR does not contain a general exception for disproportionate effort in erasure. Where a request cannot be met in full, record what you tried, why, and what you did instead. If the supervisory authority asks, that record is your answer.

Accuracy is a related duty under Article 5(1)(d). A model that produces false statements about a named person raises an accuracy issue, and our guide to the accuracy principle explains how to approach it.

A DPIA Is Likely for Most LLM Deployments

Article 35 requires a DPIA where processing is likely to result in a high risk. Article 35(3) lists three cases: systematic and extensive evaluation of personal aspects based on automated processing, including profiling; large-scale processing of special category data; and systematic monitoring of a publicly accessible area on a large scale.

An LLM that profiles customers, scores applicants, or processes health data at scale will usually meet one of these criteria. Supervisory authorities also publish lists of processing that needs a DPIA, and new technology is a common factor.

A useful DPIA for an LLM covers:

• the data flows from user to provider and back;

• the training and fine-tuning data and its source;

• accuracy and the risk of false outputs about people;

• memorisation and leakage risks;

• the effect on data subject rights; and

• the transfer route for any supplier outside the EEA.

The EDPB published a report on AI privacy risks and mitigations for LLMs in April 2025. External experts under the Support Pool of Experts programme wrote it, so it reflects their views, not an EDPB position. It sets out a risk management method and example scenarios you can use as a reference for your own assessment.

Private and Public LLM Deployments Carry Different Obligations

A private deployment runs on infrastructure you control, or on a dedicated instance. You decide retention, access, and where the data sits, and you can respond to data subject requests directly. You also carry the full compliance load and the cost.

A public API runs on the provider’s systems. Your duties depend on the contract. Check whether the provider:

• acts only on your instructions as a processor under an Article 28 contract;

• uses your prompts or outputs to train its own models, which can make it a separate controller for that use;

• lists its sub-processors and gives notice of changes; and

• supports your data subject requests and breach notification.

Our guide to sub-processors explains the contract chain. If the provider is outside the EEA, you also need a Chapter V route.

Transfers to Non-EU Providers Need a Chapter V Route

If prompts or training data go to a provider outside the EU and EEA, or can be accessed from there, you need an adequacy decision, appropriate safeguards such as standard contractual clauses, or a narrow derogation.

For US providers, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. The General Court dismissed a challenge on 3 September 2025 in Case T-553/23, and the applicant appealed in Case C-703/25 P. Check that the provider is certified, and keep standard clauses as a fallback. Our guide to transferring data outside the EU covers each route.

The AI Act Adds Duties for Model Providers

The AI Act’s rules for providers of general-purpose AI models in Chapter V began applying on 2 August 2025 under Article 113. Article 53 requires technical documentation, information for downstream providers, a policy to comply with EU copyright law, and a public summary of the content used for training. Open-source models get a partial exemption, which does not cover models with systemic risk.

Article 101, on fines for these providers, is the one provision of Chapter XII excluded from that date, so it applies from 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

These duties sit alongside the GDPR. They do not replace the need for a lawful basis or a DPIA. If you build on a third-party model, the provider’s documentation is a useful input to your own assessment. Our AI governance service covers both regimes.

The Digital Omnibus Is Not Yet Law

The Commission’s Digital Omnibus proposes GDPR changes that would address AI development, including legitimate interests for training. At the time of writing, the GDPR part is still under negotiation. The existing rules and the EDPB’s opinion are what apply today. Our article on the Digital Omnibus and AI tracks the proposals.

The UK Follows the Same Principles With Its Own Guidance

The UK GDPR applies the same lawful basis, fairness, transparency and rights rules. The ICO published an outcomes report on its generative AI consultation series in December 2024. Law-firm summaries say it keeps legitimate interests as the only realistic basis for training on scraped personal data, with a purpose test, a necessity test and a balancing test. Check the ICO’s own pages for current guidance, because the Data (Use and Access) Act 2025 has prompted updates.

A Short Checklist Keeps a Deployment on Track

Before launch, confirm that you have:

• mapped where personal data enters, leaves and is stored;

• chosen and documented a lawful basis for each purpose;

• completed a DPIA where the processing is high risk;

• reviewed the supplier contract, sub-processors and transfer route;

• updated your privacy notice to describe the AI use; and

• set up a route for access, erasure and objection requests, including prompts and logs.

Staff use matters too. A rule on which tools you may use, and what you must never paste into them, closes the most common gap. Our guide to AI-powered data breaches explains what goes wrong when this rule is missing.

Conclusion

An LLM is lawful under the GDPR when you know where personal data enters it, have a basis for each use, have tested whether the model leaks data, and can honour people’s rights in the systems you control. Anonymity claims need evidence, and supplier contracts must match how you use the tool.

We are updating this guide because the EDPB has now set out its position on AI models, the Court of Justice has clarified the test for personal data, and the AI Act’s duties for model providers are in force. Review your LLM projects against these points, and speak to our GDPR consultants if you want them checked.

Frequently Asked Questions

Does the GDPR Apply to Large Language Models?

Yes, when an LLM processes personal data in training, prompts, outputs or logs. The EDPB says a model is anonymous only if the likelihood of extracting personal data is insignificant, assessed case by case.

What Lawful Basis Can Be Used to Train an LLM?

Legitimate interests is the most workable basis for most training, because consent is rarely practical for scraped data. The EDPB says there is no hierarchy between the bases, so you must choose one and justify it. For legitimate interests, that means a documented three-step test covering the interest, necessity and balancing.

Can People Ask to Have Their Data Removed From an LLM?

Yes. Erasure applies to personal data in training sets, prompts, and logs, although removing information from model weights may require unlearning or retraining. Keep inputs and logs separate from the base model, and record your response to each request.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.