GDPR and cloud LLMs: roles, data flows and transfers

Sending a document to a cloud LLM makes its contents available outside your device. That deserves a deliberate assessment, particularly for client files or research data. It does not automatically establish either a third-country transfer or a processor relationship.

This overview was reviewed on 7 October 2026. It provides general information, not a legal assessment of a particular organisation or service configuration.

Start with the data and purpose

Identify the personal data involved, why the AI processing is needed and the applicable lawful basis. Consent is one possibility, not a universal requirement; contract necessity or legitimate interests also need their own conditions assessed. Health and other special-category data require an additional Article 9 condition. A transfer mechanism does not replace a lawful basis. The EDPB’s lawful-processing guide explains these distinctions.

Before rollout, record the actual service, recipient entities, access locations, retention, training uses and connected tools. “ChatGPT” or “cloud AI” alone is not a sufficiently precise description.

For example, eligible ChatGPT Enterprise and Edu configurations offer European storage and inference residency. These are different controls, with feature and processing exclusions; neither means that every operation stays in the selected region. Check OpenAI’s current residency documentation for the specific workspace.

When does Article 28 apply?

A processor handles personal data on a controller’s behalf. A service acting for its own purposes may instead be a controller for that processing. The factual activities determine the role, not encryption or a contractual label alone. Where a processor is engaged, Article 28 requires an appropriate contract or other qualifying legal act. See the EDPB’s controller and processor guidelines.

OpenAI publishes a Data Processing Addendum covering processing under its relevant business agreement. Verify that the agreement actually covers your service and use. A plan name, paid subscription or “no training” setting does not establish compliance by itself.

When is there an international transfer?

The EDPB identifies three cumulative conditions: an exporter is subject to the GDPR for the processing; it makes personal data available to another controller or processor; and that recipient is in a third country or is an international organisation. Off-device processing alone does not meet that test. See Guidelines 05/2021.

Where Chapter V applies, assess adequacy, appropriate safeguards such as standard contractual clauses, or a narrowly applicable derogation. Encryption can form part of safeguards but does not independently resolve every transfer requirement. The EDPB’s transfer guide explains the available routes.

The Commission’s current adequacy list includes participating US commercial organisations under the EU–US Data Privacy Framework. Check the particular recipient’s active participation and coverage; this is not blanket adequacy for every US service.

Confidentiality and risk remain separate questions

German professional secrecy rules require a separate assessment. They do not categorically prohibit every cloud service: § 43e BRAO addresses lawyers’ use of service providers, including selection, confidentiality and access conditions; § 203 StGB also regulates participating persons. A GDPR contract alone does not settle professional obligations.

A data protection impact assessment is required where processing is likely to create high risks to people’s rights and freedoms. Neither “uses AI” nor “runs locally” settles that threshold. See the EDPB’s compliance guidance.

What local processing changes

Keeping inference and storage inside your organisation can avoid sending document contents to an external AI provider. Verify that boundary across backups, remote support, optional integrations and exports too.

Local processing still requires a lawful purpose, appropriate access controls, retention decisions and respect for data-subject rights. It can simplify the data flow; it is not a GDPR certificate.

Our local-AI guide and architecture explain the technical choices. The companion article covers local AI under the AI Act.