EU · GDPR

GDPR-Compliant AI: Personal Data That Never Leaves Your Jurisdiction

Your DPO has been asked to approve a US AI vendor for a system full of EU personal data. Again.

Written by Jakub Rusinowski · Last updated 2026-08-01 · Hardware figures computed by our VRAM engine

This page is practitioner guidance on deployment mechanics, not legal advice — involve your counsel or DPO for decisions about your specific obligations.

GDPR-compliant AI is a question of who processes personal data, where, and on what legal footing — not of which model you pick. Self-hosting an open-weight model collapses three of the hardest problems at once: there is no processor to bind under Article 28, no third-country transfer to justify under Chapter V, and no vendor retention term to reconcile with your own. What remains is ordinary controller work you already do: lawful basis, transparency, records, and a DPIA where the processing warrants one.

Why this is hard

What the deployment gives you

No Chapter V transfer, because nothing transfers

Inference on hardware in your own facility or an EU datacentre means personal data never crosses a border. There is no adequacy decision to rely on, no standard contractual clauses to paper, and no transfer impact assessment to refresh every time the case law moves.

Article 30 records that survive an audit

A self-hosted deployment has one processing location, one retention policy, and one set of recipients — yours. Describing it in your record of processing activities takes a paragraph instead of a diagram with a dotted line leaving the page.

Erasure you can actually perform

Retrieval over an index you control makes Article 17 a delete operation with a verifiable result. This is the architectural reason to prefer RAG over fine-tuning on personal data: you can delete from an index, and you cannot meaningfully delete from frozen weights.

Data minimisation enforced before the prompt

A gateway that strips direct identifiers and scopes retrieval to the purpose turns Article 5(1)(c) into a pipeline stage. Minimisation asserted in a policy document is an intention; minimisation in code is a control.

Where the personal data goes — and where it stops

The open-weight model itself is the one component that comes from outside. It arrives once, as a file, and it contains no personal data of your data subjects; from then on every byte of personal data stays on your side of the boundary. That asymmetry is what makes the compliance story short.

Where the personal data goes — and where it stopsController-operated environment — EU/EEA. 1. Open-weight model: Downloaded once from the publisher. A file, not a service — no ongoing data relationship. 2. Application & gateway: Minimises input, scopes retrieval to purpose, logs the lawful basis with the request. 3. Inference server: Your GPUs, your jurisdiction. No telemetry, no vendor callback, no training on your inputs. 4. Document index: Erasable per data subject. Deleting a record here genuinely removes it from future answers.CONTROLLER-OPERATED ENVIRONMENT — EU/EEAOpen-weight modelDownloaded once from thepublisher. A file, not aservice — no ongoing datarelationship.Application & gatewayMinimises input, scopesretrieval to purpose, logsthe lawful basis with therequest.Inference serverYour GPUs, yourjurisdiction. No telemetry,no vendor callback, notraining on your inputs.Document indexErasable per data subject.Deleting a record heregenuinely removes it fromfuture answers.

What you have to satisfy

Models that fit this deployment

模型VRAM (Q4)可运行于上下文许可
Mistral Small 3.1 24B
EU-published, Apache 2.0 — 16 GB card — A capable European open-weight model where provenance itself is part of the procurement argument.
ollama pull mistral-small3.1		15 GB24 GB GPU (RTX 3090/4090)
Mac: 24 GB 统一内存		125KApache 2.0
Qwen 3 32B
Department tier — one 24 GB card — Permissive licence, strong multilingual behaviour across EU languages, single-card deployment.
ollama pull qwen3:32b		20.6 GB24 GB GPU (RTX 3090/4090)
Mac: 32 GB 统一内存		125KApache 2.0
Llama 3.3 70B Instruct
Organisation tier — 48 GB class — The reference open 70B for knowledge work; note the community licence when your legal team reviews terms.
ollama pull llama3.3:70b		43.1 GB2×24 GB GPUs or 48 GB card
Mac: 64 GB 统一内存		128KLlama Community

Need AI your DPO will actually sign off on?

We help European organisations deploy AI that keeps personal data inside their own jurisdiction and their own control — architecture review, model selection, retrieval design, and the documentation your data protection officer needs to see. Vendor-neutral, practitioner-level, no platform to sell you.

Ask about a workshop →

常见问题

Is using ChatGPT a GDPR violation?
Not inherently — it depends on lawful basis, transparency, the contract, and where the data ends up. Using a hosted model with personal data makes the provider a processor, so you need an Article 28 agreement, a documented sub-processor chain, a Chapter V transfer mechanism if processing happens outside the EEA, and a retention position that matches your own. Enterprise tiers can satisfy much of this contractually; consumer tiers generally cannot, and pasting personal data into one without a basis is where organisations get into difficulty.
How does the right to erasure work when a model has been trained on personal data?
Honestly, badly — which is the point. Once data is in the training set it is diffused across billions of weights, and there is no reliable operation that removes one person from a trained model. Machine-unlearning research exists but is not something to promise a supervisory authority. The practical answer is architectural: keep personal data in a retrieval index rather than the training corpus. Then erasure is a delete from a store you control, with a result you can demonstrate, and the model itself never held the data.
Does self-hosting mean we do not need a DPIA?
No. Article 35 turns on the risk of the processing, not on who owns the servers. If you are processing special-category data at scale, systematically evaluating people, or deploying a new technology in a way likely to result in high risk, you need a DPIA. Self-hosting usually makes that DPIA much shorter — the transfer section becomes "none", the recipients section becomes "no third party" — but skipping the assessment because the hardware is yours is not a defensible reading.
Do open-weight models count as personal data?
The weights of a general-purpose model published by a third party are not a record of your data subjects, and treating the model file as personal data is not a useful framing. The regulated question is what you feed the model and what you keep: prompts, retrieved documents, completions, and logs are all likely to contain personal data and all fall inside your record of processing. Where it gets genuinely unsettled is a model you fine-tuned on personal data yourself, since it may have memorised examples — another reason to prefer retrieval.
Does the EU AI Act change any of this?
It adds a separate obligation layer rather than replacing GDPR. The AI Act regulates you by role — provider versus deployer — and by risk classification of the use case, while GDPR continues to regulate personal data in the same system. Most organisations deploying an internal assistant are deployers of a limited-risk system with transparency duties, but the classification is use-case specific and worth doing deliberately. Our EU AI Act guide covers the roles and the timeline in detail.

Go deeper