GDPR-compliant LLM hosting: what actually matters.
GDPR-compliant LLM hosting comes down to three questions: who processes the personal data (Article 28), how it is secured (Article 32), and whether it leaves the EU (Chapter V). Hosting the model on your own EU infrastructure collapses most of that analysis: no processor chain, no transfer, and a single security boundary you control.
Who processes the data when you use a cloud LLM?
Send personal data to an LLM API and the provider becomes a processor under Article 28, so you need a data processing agreement with them, and their subprocessors join your chain. Every party on that chain is an answer you owe on the next security questionnaire; “our SOC 2 auditor is asking about AI subprocessors” is one of the most common problems that lands in our inbox. Run inference on your own hardware and there is no processor for that step at all; you remain the controller, on infrastructure you already answer for.
Does an EU region on a US cloud settle the transfer question?
Not entirely, and it’s worth being precise, because this is where most content overclaims. EU–US transfers are currently lawful under the Data Privacy Framework, which survived its first court challenge (Latombe, General Court, September 2025), with a route to the CJEU still open. But adequacy arrangements have been struck down twice before (Safe Harbour in 2015, Privacy Shield in 2020), and a US-headquartered provider may be subject to US legal process under the CLOUD Act regardless of which region hosts your data. The point is not that using a US cloud is illegal; it is that you are building on a political instrument with a history. On your own hardware, the Chapter V analysis never starts.
How hosting choices map to the GDPR articles.
| Question | Cloud LLM API | Your own EU infrastructure |
|---|---|---|
| Art. 28: processors | Provider plus their subprocessor chain, on their terms. | No processor for inference. Your existing controller duties, nothing added. |
| Art. 32: security | Their measures, verified on paper through certifications. | Your measures, verified by inspection. One boundary, also yours to get right. |
| Chapter V: transfers | Depends on region, adequacy, and contract mechanics. | Does not arise. The data stays put. |
| The auditor's data-flow question | A diagram with third parties on it. | “It never leaves the building.” |
What self-hosting doesn’t solve.
GDPR still applies to you as controller: lawful basis, purpose limitation, data subject rights, retention, and a data protection impact assessment when you process employee or customer data at scale. Article 32 doesn’t disappear either; the security burden shifts to you, which is why access control, logging, and retention are part of every deployment we build rather than an afterthought. On-premise removes the transfer and processor layers. It does not remove the regulation.
Where this fits in the bigger compliance picture.
GDPR is usually one half of the question; the EU AI Act is the other. The deadlines there changed in July 2026 and most published content is now out of date; here is the AI Act timeline as it actually stands, and what self-hosting changes. And if you’re still weighing whether to run your own model at all, start with when not to self-host an LLM.