GDPR compliant AI: where your data goes and how to keep it in the EU

GDPR compliant AI is less about the model and more about the route your data takes. When an employee pastes a customer email into a chatbot, or an agent calls a model through an API, personal data goes to a provider that acts as your processor, is often stored for abuse monitoring for up to 30 days, and may be processed outside the EU unless you choose otherwise. To stay compliant you need four things: a data processing agreement under Article 28 GDPR, a deployment that processes data in the EU or Germany, training on your data switched off, and a lawful basis for any transfer to the US.

This guide reflects the position on 11 October 2026. Vendor options change every few months, so confirm each setting in your own contract and console.

#Where your data goes when someone uses an AI model

A single prompt rarely makes one trip. Map these hops before you debate which model is best, because each one is a recipient, a storage location or both.

1. The interface. A browser chat, an Office add-in, a CRM plugin. Consumer and business tiers have different terms, even from the same vendor.
2. Your orchestration layer. The server or low-code tool that builds the prompt and stores state. If it is a US-hosted SaaS, data has left the EU before any model sees it.
3. The model endpoint. Where inference physically runs. 'Global' deployments can route a request to any region with spare capacity.
4. Provider safety storage. Most providers keep prompts and outputs for abuse monitoring, typically for up to 30 days, unless you are approved for zero data retention.
5. Stateful features. Threads, stored responses, files, vector stores and caches persist until you delete them.
6. Tools the agent calls. Web search, grounding, email, ticketing. Each tool call can send personal data to another recipient.
7. Your own logs. Prompt logs, tracing tools and evaluation datasets often hold the most complete copy of all.

#Controller, processor and the data processing agreement

When your company decides why and how personal data goes into an AI service, you are the controller. A provider that runs the model only on your instructions, such as Microsoft for Azure OpenAI or AWS for Bedrock, is normally your processor. The DSK, the joint body of Germany's data protection authorities, takes the same view: using an external cloud AI application for your own purposes usually creates a processing relationship under Article 28, which requires a contract. If you run an open-weight model on your own servers for your own purposes, you are usually the sole controller and there is no model vendor to contract with.

In practice the DPA is the vendor's standard addendum to its enterprise or API terms. Consumer logins usually come without one, and the DSK assumes uncontrolled staff use of such tools is already reality in many organisations: close that gap first.

• Processing only on your documented instructions, including no use of your data to train the provider's models (Article 28(3)(a)).
• A current list of sub-processors with their locations, and a right to object to new ones (Article 28(2) and (4)).
• Where processing and storage happen, stated separately, including support access from outside the EU.
• Retention periods for prompts, outputs, files and logs, and deletion at the end of the contract (Article 28(3)(g)).
• The transfer mechanism for anything processed outside the EEA: adequacy, standard contractual clauses or both.
• Security evidence, for example ISO/IEC 27001 certification or a BSI C5 attestation.

#International transfers: the Data Privacy Framework, SCCs and the CLOUD Act

Chapter V of the GDPR (Articles 44 to 49) allows transfers outside the EEA only on the basis of an adequacy decision, appropriate safeguards such as standard contractual clauses (SCCs), or a narrow derogation. For the US the adequacy decision is the EU-US Data Privacy Framework of 10 July 2023. It only covers US companies that have self-certified, so check each provider on the official DPF list.

Status on 11 October 2026: the framework is in force. The General Court dismissed Philippe Latombe's annulment action on 3 September 2025 (Case T-553/23); his appeal (Case C-703/25 P) is pending before the Court of Justice. On 29 June 2026 the US Supreme Court held in Trump v. Slaughter that the President may remove FTC commissioners at will. The FTC's independence is a pillar of the adequacy decision, so noyb asked the Commission to withdraw it and announced a further court challenge. Until a court or the Commission acts, transfers to certified companies remain lawful.

SCCs (Commission Implementing Decision (EU) 2021/914) need a transfer impact assessment: does US law, notably FISA Section 702 surveillance, undermine the clauses, and which supplementary measures close the gap? A model has to read plain text to answer, so encryption helps only in transit and at rest; minimising what you send does most of the work.

EU data residency does not end the discussion. The US CLOUD Act lets US authorities require US providers to disclose data in their possession, custody or control, wherever it is stored. Processing in Frankfurt by a US provider's EU entity is not itself a transfer, but the EDPB says the risk of 'conflicting national laws or disproportionate government access' must still be weighed when you choose a processor. For most business data that is a documentable risk; for professional secrets, many organisations choose an EU-owned provider or self-hosting.

#EU data residency options from the major providers

Every major platform now offers EU processing, but the defaults differ. The table reflects each provider's documentation as checked in October 2026.

Two distinctions matter more than the brand. Storage location and processing location are separate promises: several 'global' options store data in the EU but run inference elsewhere. And a US provider's EU region solves the transfer question, not the CLOUD Act question.

Self-hosting has become realistic. With retrieval-augmented generation (RAG), a mid-sized open-weight model answering from your own documents is often good enough for internal search and drafting. The DSK's October 2025 RAG guidance notes that this allows smaller, locally run models without passing personal data to hyperscalers, but that RAG does not cure a model trained unlawfully.

#Training on your data, logging and retention

Business and API terms of the major providers exclude training on your prompts without permission. Consumer plans differ. OpenAI and Anthropic let consumer users decide whether chats train future models, and Anthropic keeps consumer chats for up to five years where a user allows training. That is why the DSK wants staff on company accounts, with training and chat history switched off by default.

• Provider abuse monitoring. Up to 30 days by default at OpenAI and for some Bedrock models; Azure stores prompts selected for human review in your geography unless you are approved for modified abuse monitoring.
• Zero data retention. Available from the major providers for eligible customers, but usually not for stateful features such as files, vector stores or code execution.
• Stateful features. Stored responses, threads and uploaded files stay until you delete them. Turn storage off where you do not need history.
• Your own logs. Fix a period (for example 30 days for full prompt logs), pseudonymise user IDs, restrict access and delete automatically. Article 5(1)(e) requires it, and a log you do not keep cannot leak.

Prompt logs that identify employees can monitor behaviour or performance, which triggers the works council's co-determination right under § 87(1) no. 6 BetrVG, so agree the logging design in a works agreement before rollout.

#What the German DSK expects, and when you need a DPIA

Three DSK papers matter for AI users: the May 2024 guide on AI and data protection, the June 2025 guide on technical and organisational measures, and the October 2025 guide on RAG. They are not binding, but they show how the authorities that would audit you read the GDPR.

In English: technically closed systems, where you control inputs and outputs and the provider does not train on them, are preferable from a data protection point of view. The same guide asks you to check that the model was trained lawfully, exclude training on your inputs where possible, set written internal rules on which tools may be used for what, and give staff company devices and accounts rather than private ones.

A data protection impact assessment (DPIA) under Article 35 is mandatory where processing is likely to result in a high risk, and the DSK expects that to be the case for many AI deployments. Its mandatory list for the private sector names, as item 11, the use of AI to process personal data to steer interaction with data subjects or to evaluate personal aspects, with AI customer support as the example. Typical triggers:

• A customer-facing chatbot or voice agent that processes personal data.
• AI that scores, ranks or profiles people: applicants, employees, credit or fraud risk.
• Special category data under Article 9, such as health data, or data about children.
• Systematic monitoring of employees, including analysis of their prompts.

If a high residual risk remains, Article 36 requires you to consult the supervisory authority before going live. Ask providers early for the documentation you need to assess the risk.

#Which setup fits which data

A worked example

A hypothetical 400-person logistics company in North Rhine-Westphalia wants an agent that reads around 1,500 customer emails a week, drafts replies and updates the CRM. The emails contain names, addresses and complaints about damaged goods: ordinary personal data, but customer-facing and at scale, so a DPIA is due.

A sensible setup: orchestration in the company's own Azure tenant in Germany, an EU DataZone model deployment, stored responses off, prompt logs kept 30 days with pseudonymised IDs, CRM access limited to draft notes, and a person approving each reply. Microsoft's DPA covers the processing, the framework and SCCs cover residual US access, and the works council agrees the logging design.

#Checklist: before you switch it on

#How we can help

Bespoke IT Consultants builds AI agents and automations for companies in the DACH region, with EU or German hosting chosen per use case. An AI audit maps your tools, data flows and gaps, or get in touch to talk through a specific use case. For legal sign-off, involve your data protection officer and, for high-risk cases, a lawyer.