GDPR, LLMs and customer data: a safe-use guide for SaaS

You can use customer data in LLM features under GDPR if you treat the model provider like any other processor and apply the usual rules: a lawful basis for each purpose, only the data the feature needs, a processor contract, clear retention, transparency to customers and a risk assessment. Ireland's Data Protection Commission states plainly that where an AI system processes personal data, the GDPR and data protection legislation will apply. The eight steps below turn that into work a SaaS team can do this month.

Key takeaways

• GDPR applies to LLM features in full whenever personal data is processed; there is no AI exemption.
• Identify a lawful basis per purpose; the EDPB's Opinion 28/2024 sets out the three-step test if you rely on legitimate interest.
• Send the model only the data each task needs, and keep personal data out of training or fine-tuning unless you can justify and unwind it.
• Check the provider's training, retention and region terms: both OpenAI and Anthropic say they do not train on API data by default and delete it within 30 days unless agreed otherwise.
• Run a DPIA for new or higher-risk uses and keep a human in the loop for decisions with significant effects on people.

Does GDPR allow customer data to be sent to an LLM?

Yes, provided the processing meets the same GDPR requirements as any other system. The LLM provider is usually your processor, so you need a contract under Article 28, which requires processing to be governed by a contract or other legal act setting out its subject matter, purpose and the processor's obligations. The core principles in Article 5 also apply, including purpose limitation and data minimisation: data must be adequate, relevant and limited to what is necessary.

The DPC's guidance for organisations using AI products lists specific risks to manage: unanticipated processing, data subject requests you cannot fulfil, staff or customers entering personal data into third-party tools, models reproducing passages of (personal) training data, and reliance on inaccurate outputs without human review.

Step 1: Which lawful basis covers the AI feature?

Choose a lawful basis for each distinct purpose, not one for "AI" in general. Answering a customer's own support question may fall under the contract you have with them; analysing all customers' tickets to improve your product is a different purpose that needs its own basis.

If you rely on legitimate interest, the European Data Protection Board's Opinion 28/2024, adopted in December 2024 at the request of Ireland's DPC, recalls the three-step test: identify a legitimate interest, check that the processing is necessary for it, and check that it is not overridden by people's interests and rights (the balancing test). The opinion stresses people's reasonable expectations in the balancing test, and says interests must be lawful, clearly articulated and real rather than speculative.

Step 2: What data should the model actually see?

Only what the task needs. Practical minimisation for LLM features:

• Send the ticket text, not the full customer record.
• Replace names, emails and account numbers with placeholders where the answer does not depend on them, and restore them after the response.
• Filter retrieval so a user only receives passages from documents they are allowed to see.
• Keep special category data, such as health data, out unless you have a specific legal basis and have assessed it.

The EDPB opinion asks supervisory authorities to pay particular attention to the amount of personal data processed when assessing necessity, in light of data minimisation.

Step 3: What should you check in the provider's terms?

Check four things: training use, retention, region and sub-processors. Public documentation from two large providers, as of November 2026:

Question	OpenAI API	Anthropic API
Trained on your API data by default?	No, unless you opt in	No, for commercial products
Default retention	Abuse monitoring logs up to 30 days	Inputs and outputs deleted within 30 days, with stated exceptions
Shorter retention	Zero Data Retention, subject to approval	By agreement, for example zero data retention
EU region	Europe (EEA and Switzerland) region available, with conditions	Check current options for your contract and platform

Read the data processing agreement, the sub-processor list and the transfer mechanism for any processing outside the EEA. Our article on the EU-US Data Privacy Framework explains when US tools are permitted.

Step 4: Should customer data be used to train or fine-tune a model?

Avoid it unless you have a strong reason and a way to honour data subject rights. The EDPB opinion states that AI models trained with personal data cannot, in all cases, be considered anonymous, and that anonymity must be assessed case by case. Personal data that ends up in model weights is hard to delete or correct. Retrieval-based designs keep the data in a database you control; our comparison of RAG vs fine-tuning explains the trade-off.

Step 5: Do you need a DPIA?

Often, yes. Article 35 requires a data protection impact assessment where processing, in particular using new technologies, is likely to result in a high risk to people. The DPC notes that AI use may require a DPIA, particularly when the technology is new to you, when you combine datasets, or when you process data about children or vulnerable people, and that one can be good practice even when not strictly required (DPC guidance). Our guide to a DPIA for AI features walks through the template.

Step 6: What must customers be told?

Tell people what the feature does with their data, in your privacy notice and at the point of use. State the purpose, the lawful basis, the provider category (processor), any transfers outside the EEA and how long data is kept. If the AI interacts directly with customers, Article 50(1) of the EU AI Act separately requires that people are informed that they are interacting with an AI system unless it is obvious.

Step 7: How do you handle access and deletion requests?

Design for them before launch. The DPC asks organisations directly whether they can respond to requests to access or delete personal data held within an AI system. In practice, log prompts and outputs only where needed, link logs to customer IDs so you can find and delete them, apply retention limits to logs and vector indexes, and make sure deleting a source document also removes its embeddings.

Step 8: When must a person review the AI's output?

Whenever the output feeds a decision with legal or similarly significant effects on a person. Article 22 gives people the right not to be subject to a decision based solely on automated processing with such effects, subject to exceptions that still require safeguards including the right to obtain human intervention. Credit, hiring, insurance and account termination decisions are obvious examples. Also test for personal data leaking through outputs: the OWASP Top 10 for LLM applications lists sensitive information disclosure as a top risk.

What is the checklist?

• [ ] Purposes listed, each with a lawful basis (and a legitimate interest assessment where used)
• [ ] Data sent to the model minimised and pseudonymised where possible
• [ ] Processor agreement, sub-processor list and transfer mechanism reviewed
• [ ] Provider settings confirmed for training use, retention and region
• [ ] No personal data in training or fine-tuning without a documented justification
• [ ] DPIA completed or a documented decision that one is not needed
• [ ] Privacy notice and in-product notice updated
• [ ] Access and deletion process covers logs, caches and vector indexes
• [ ] Human review for decisions with significant effects
• [ ] Tests for personal data leakage and prompt injection before launch

Frequently asked questions

Is an LLM provider a processor or a controller under GDPR?

When you send customer data to an API to perform a task for you, the provider normally acts as your processor and you remain the controller. That depends on the contract and on the provider not using the data for its own purposes, such as training, so check the terms and settings.

Do I need customer consent to use an LLM on their data?

Not necessarily. Consent is one of several lawful bases, and contract or legitimate interest may fit better for features customers expect. Whatever basis you choose must match the specific purpose, and legitimate interest requires the three-step test described in EDPB Opinion 28/2024.

Can I use a US-based LLM provider for EU customer data?

Yes, if a valid transfer mechanism covers the transfer, such as the EU-US Data Privacy Framework for certified companies or standard contractual clauses, and you have assessed the provider. Some providers also offer EU data residency, sometimes with conditions or an added price.

What did the EDPB's Opinion 28/2024 decide?

Adopted in December 2024 at the Irish DPC's request, it addresses when AI models can be considered anonymous, how legitimate interest can be used in developing and deploying models, and what happens when a model was developed with unlawfully processed data. It gives criteria for case-by-case assessment rather than blanket rules.

Does the DPC have specific guidance on AI and LLMs?

Yes. The DPC published 'AI, Large Language Models and Data Protection' in July 2024, covering risks for organisations using AI products, DPIAs, retention, third-party products and data subject rights. It is a short, practical read for any team adding AI features.

If you want help reviewing an AI feature against GDPR before launch, book a free 30-minute call.

Cover photo by AMORIE SAM on Pexels.