GDPR-Compliant AI: On-Premise & EU LLMs vs ChatGPT

Definition: GDPR-compliant AI means that the specific processing of personal data meets applicable data-protection requirements. These include lawful basis, purpose limitation, minimisation, security, transparency and rights, plus processor arrangements and transfer rules where relevant. On-premise or EU hosting alone is insufficient.

An internal document assistant needs a defined data boundary and tested access rights. This guide addresses two common questions — is ChatGPT GDPR-compliant? and how do I prevent data outflow — by comparing local operation, EU cloud and external services. Reviewed on 8 September 2026.

Is ChatGPT GDPR-compliant?

Assess the specific product, contract and use case. Business products and APIs can offer organisational controls, but a plan name does not establish GDPR compliance. Determine roles, lawful basis, processing locations, retention, training use and available rights procedures. EU residency and Zero Data Retention are controls with product-specific conditions, not universal GDPR requirements or a complete approval.

For every provider, distinguish the hosted service from locally deployed model weights. For Microsoft Copilot, document the exact product and tenant settings, including Flex Routing where available. A DeepSeek-branded hosted service and downloaded weights used on your own infrastructure have different data flows and responsibilities; a brand-wide compliance verdict is not a substitute for assessment.

What makes an AI GDPR-compliant? (checklist)

Roles and contracts: identify controller and recipients; conclude Article 28 terms where a provider acts as a processor.
Lawful basis (Art. 6) for the processing.
Data flows: document inference, storage, support, backups and subprocessors. Assess any third-country transfers under Chapter V.
Retention: set purpose-based periods and deletion procedures for documents, prompts, outputs, vectors, caches, logs and backups.
Purpose and minimisation: restrict processing to the approved purpose and necessary data. Assess any training or other reuse separately.
Rights and risk: enable data-subject rights and assess whether Article 35 requires a DPIA before processing.

International access and AI: what to assess

The US CLOUD Act

The CLOUD Act can require covered providers to disclose data within their possession, custody or control even when stored abroad. This does not create unlimited government access or a blanket GDPR ban on US services. Assess the relevant legal entity, actual access, safeguards and applicable transfer mechanism.

GDPR Art. 48 vs. CLOUD Act

Article 48 does not make a foreign authority’s request a lawful basis by itself. Recognition or enforcement of an order is distinct from the lawfulness of disclosure. The final EDPB Guidelines 02/2024 require assessment of both Article 6 and Chapter V; international agreements and other potentially applicable grounds must be considered in their specific context.

Schrems II and the EU-US Data Privacy Framework

Schrems II invalidated the former Privacy Shield. The Commission’s July 2023 adequacy decision for the EU-US Data Privacy Framework is a separate instrument. For a proposed transfer, verify the recipient’s active participation and the covered data and service. The existence of the framework does not remove the other GDPR requirements.

Retention & training on your data

Training use, abuse monitoring and application storage are different questions. OpenAI’s API documentation states that API data is not used for training by default unless customers explicitly opt in. Retention varies by feature and approved controls; application state may remain relevant even where Zero Data Retention is enabled. Check the actual endpoints and your own logs.

Hosting choices: compare controls, not compliance tiers

External AI service: verify the contract, roles, purposes, data flows, processing and storage locations, retention and technical controls for the exact service.
EU-region cloud: assess support, administration, subprocessors and transfer mechanisms in addition to the physical region.
Sovereign cloud: specify the promised control over operator, jurisdiction, encryption keys, administration and exit. The label is not a GDPR certification.
On-premise: local processing can reduce external data flows, but connected tools, updates, telemetry, support and backups still require assessment.

On-prem vs. EU-cloud vs. sovereign-cloud

Criterion · On-premise · EU cloud (US provider) · EU sovereign cloud

Data control — direct technical control · shared contractual and technical control · verify each promised control
Legal access exposure — assess the operator, subprocessors, remote access and key control in every deployment model; none of these labels proves zero risk.
Upfront cost — high · low · medium
Setup time — depends on integration, permissions, testing, approvals and operational handover in all three models.
Scalability — limited · high · high

Which open-weight LLMs can you run on-premise?

Specific versions of the Mistral, Llama, Qwen, Gemma and other model families can be deployed locally where weights are available and the applicable licence permits the intended use. Open weights do not mean unrestricted open-source licensing.
European-developed options include models from OpenGPT-X, Aleph Alpha and Mistral. Assess the exact model and licence independently from the developer’s location. European origin alone does not establish suitability, anonymity or compliant processing.

What does on-premise AI cost?

Compare total cost over the same period: hardware or rental, energy, licences, integration, operations, resilience, privacy work and exit. A fixed hardware price or universal break-even period cannot represent every workload. On-premise is one possible architecture, not a general legal prerequisite; lawful basis, rights, security and any required DPIA remain necessary.

Decision framework: which tier for your risk level

High-protection data: first determine whether external processing is permitted; then compare a controlled local design with cloud options capable of meeting the documented requirements.
Sensitive data and limited operations capacity: assess managed options against contracts, actual access, technical controls and exit requirements.
Routine business work: choose only among options approved for the relevant data and purpose; measure answer quality and total operating cost.
Public content: account information, usage logs or generated outputs may still contain personal data. Do not treat public source documents as proof that the entire service is outside GDPR.

A protection-class-aware router (see our LLM router guide) can enforce approved destinations only when routing, fallback and failure behaviour are configured and tested. A router alone does not establish compliance.

ADVISORI: plan the deployment and its evidence together

ADVISORI can support the assessment of local and managed operating models. Define the use case, documents, permissions, external recipients and operations team first. For any proposed infrastructure or routing product, require concrete evidence of data flows, access, retention and fallback behaviour; a partnership or product name alone does not prove these controls.

Schrems II, the Data Privacy Framework and GDPR Art. 48: the legal core

The Commission continues to present the EU-US Data Privacy Framework as a transfer instrument for participating US recipients. Verify the specific recipient’s active certification and scope at the time of transfer. Where it does not cover the proposed processing, another valid Chapter V mechanism is needed, such as standard contractual clauses with the required assessment. Track material changes to the legal and operational basis; do not treat all US transfers as prohibited.

The final EDPB Guidelines 02/2024 distinguish recognition and enforceability of a foreign order from the legal basis and transfer ground for disclosure. A request alone provides neither. Assess Article 6 and Chapter V, the relevant international agreement if any, and any other applicable basis or narrowly interpreted derogation. Build an escalation process for requests instead of assuming that a hosting label removes the issue.

Which on-premise LLMs are suitable? (comparison)

Not every model fits every protection class. The main on-premise-deployable models:

Model · Origin · License · Note

Teuken-7B — verify the exact release, licence and available weights; test suitability for the intended task.
Aleph Alpha (Pharia) — verify the exact release, licence and available weights; test suitability for the intended task.
Mistral / Mixtral — verify the exact release, licence and available weights; test suitability for the intended task.
Llama 3 (up to 70B) — verify the exact release, licence and available weights; test suitability for the intended task.
Qwen3 / Gemma 3 — verify the exact release, licence and available weights; test suitability for the intended task.

Select a concrete model version, licence and architecture, then test the intended task. European origin does not establish maximum privacy, and a large model does not establish the best task performance. For document assistants, source permissions, traceable answers and controlled data flows are essential parts of the assessment.

GDPR-AI checklist: 12 points before go-live

Roles and processors: document the controller, recipients, applicable Article 28 terms and subprocessor arrangements.
Lawful basis: assess Article 6 for each purpose and an Article 9(2) condition where special categories of data are involved.
Processing locations: map inference, storage, backups, remote support and other recipients.
Deletion: define purpose, period, owner and tested deletion procedure for each data store.
Training: distinguish inference, your own training and provider reuse; prevent unapproved secondary processing.
Minimisation: limit source documents, retrieved passages, prompts and outputs to what the approved purpose requires.
DPIA: assess Article 35 and relevant supervisory lists, and conduct the assessment before processing where required.
Rights: establish workable access, rectification, erasure, restriction and objection procedures.
Transfers: identify the actual recipient and Chapter V mechanism and maintain the evidence.
Access exposure: assess administrators, support, subprocessors and relevant disclosure obligations.
Permissions: enforce the requesting user’s source permissions; an index service account must not grant everyone its access.
Security and evidence: test Article 32 measures and use proportionate logs. Storing every prompt indefinitely is not an accountability requirement.

What an on-premise LLM cannot do (the limits)

On-premise is not a silver bullet. Three honest caveats:

Task quality: small models may suit bounded tasks, but suitability must be demonstrated with representative data. Parameter count and country of origin are not acceptance tests.
Operational burden: hardware, updates, monitoring and scaling are on you — that requires MLOps capability.
Privacy: local deployment does not automatically remove all external flows. Lawful basis, rights, retention, security and the DPIA decision remain part of the assessment.

This is exactly where protection-class-aware routing can help constrain approved destinations. Test classification, blocked requests, external tools and fallback behaviour; do not rely on a model to make the privacy decision on its own.

FAQ

Is ChatGPT GDPR-compliant?

There is no universal answer for a brand or subscription. Assess the exact service, contract, data and use case. Organisational controls may help, but EU residency and Zero Data Retention alone do not establish compliance and are not universal GDPR requirements. Private consumer use is not a substitute for enterprise approval.

What makes an AI GDPR-compliant?

Compliance concerns the actual processing: lawful basis, purpose, minimisation, security, transparency, rights, appropriate role and contract arrangements, and lawful transfers where relevant. Conduct a DPIA when Article 35 requires it. No product label replaces this assessment.

What is on-premise AI / a private LLM?

An on-premise LLM runs on infrastructure under your control. To keep processing within the intended boundary, also assess document ingestion, embeddings, telemetry, tools, backups and remote support. The location alone does not make the system GDPR-compliant.

Which LLMs can run on-premise?

Available weights from specific Mistral, Llama, Qwen, Gemma and other model releases can support local deployment, subject to licence and hardware requirements. Verify the exact release and test the intended use; a downloadable model is different from a hosted service using the same brand.

Is Microsoft Copilot GDPR-compliant?

Assess the exact Copilot product, tenant, contract and data sources. Microsoft documents configurable Flex Routing that can allow inference outside the EU Data Boundary at peak demand. Record the setting and transfer arrangements. A DPIA is required where the Article 35 threshold is met, not automatically because the product is called Copilot.

How does the CLOUD Act conflict with GDPR?

Covered disclosure demands may concern data stored abroad. A request is not itself a GDPR lawful basis or transfer ground. Assess the actual entity and access, Article 6, Chapter V and the Article 48 context; neither an EU region nor on-premise deployment automatically resolves every scenario.

What does on-premise AI cost?

Calculate full lifecycle cost for the required quality, context length, concurrency and availability. Include integration and staff time. The illustrative calculation below demonstrates the method; it is not a supplier quote, current market price or promised payback.

References

Primary sources and review date: GDPR; the German Data Protection Conference’s AI guidance; EDPB Opinion 28/2024 and final Guidelines 02/2024; and current provider documentation. Direct sources and a practical approval record follow below. Reviewed on 8 September 2026.

Approval record: an internal document assistant

Define one pilot use case, such as questions about approved work instructions. Record purpose, users, sources, data categories, lawful basis, accountable owner and excluded uses. HR files, health data and automated employment decisions must not silently enter the same approval scope.

Map the complete flow: source → import/OCR → document chunks and embeddings → index → authorised retrieval → prompt → model → response. Add caches, logs, backups, support and tools. Local inference does not keep processing local if OCR or embeddings send documents to an external service.

Permission test: use two test accounts with different source permissions. Account A can read a document; account B cannot. Test direct questions, summaries and indirect questions. B must receive neither the protected passage nor its content in an answer. Repeat after access revocation and re-indexing. A system prompt is not an access-control boundary.

Deletion test: remove a synthetic test document through the planned procedure. Check source, index, chunks, caches and chat history, and the documented treatment of backups. After the defined period, deleted content must not reappear as a source. Record any separately justified retention.

Egress test: block unapproved external destinations and inspect actual connections, including failure handling, model changes, search tools and fallback routes. A local model failure must not silently send personal data to a cloud endpoint.

Acceptance record: capture expected behaviour, observed result, evidence, unresolved defect and owner for each test. Business, operations and privacy functions review their respective responsibilities. Approval applies to the documented scope; new sources, tools, models or purposes require reassessment.

RAG, pseudonymisation and model weights

RAG supplies retrieved passages to a model without requiring base-model retraining. Personal data may still be present in source documents, chunks, embeddings, prompts, logs and responses. RAG is not a GDPR exemption. A locally stored model is not automatically anonymous either; EDPB Opinion 28/2024 calls for assessment of the actual model and circumstances.

Pseudonymisation can reduce risk but is not automatically anonymisation. A mapping table, indirect identifiers or unusual facts may preserve identifiability. Test detection failures and re-identification risk; replacing names alone does not remove GDPR obligations.

Illustrative total-cost calculation

Illustrative assumptions only, not market prices: €24,000 hardware over 36 months equals about €667 per month. Add €120 energy, 16 operations hours at €95 (= €1,520), and €400 software and backup. Total: about €2,707 monthly. Initial integration and additional resilience are not included in this example.

Compare cloud operation at the same quality, load, availability and privacy requirements. Use cost per successfully completed business task rather than tokens alone. Local operation may be attractive, but utilisation and your operations team determine the result.

Prepare a concrete ADVISORI enquiry

Provide the use case, data categories, source systems, user count and concurrency, preferred deployment and available operations capacity. Identify unresolved decisions. These inputs help scope a technical assessment, architecture plan or pilot, with agreed outputs such as a data-flow map, option comparison, permissions concept and acceptance plan.

Coordinate legal assessment and required approvals with the responsible functions. Technical tests and consulting outputs support that assessment; they are not a blanket GDPR certification.