GDPR and AI: what to check before deployment

Start with the use, not the hosting label

An AI platform can help enforce access, retention and review rules. GDPR compliance depends on the purpose, data and full processing chain of the particular use. A European region, a private deployment or a zero-retention setting is not a legal conclusion.

Map the data journey

Describe what enters the workflow and where it can appear: source documents, prompts, retrieved passages, embeddings, outputs, logs and backups. Identify the controller and processors, including any model service or support provider.

Before using personal data, document a lawful basis, the required processor arrangements and information for the people concerned. Assess whether a DPIA is required and whether rules on automated decisions with significant effects apply. Health and other special-category data need an applicable additional condition.

RAG helps organise data; it is not a compliance exemption

Retrieval-augmented generation can let a system consult documents without using them to train model weights. It still processes data: retrieved text can enter a prompt, outputs and logs. Permissions must apply at retrieval, and deletion needs to cover relevant indexes and copies.

Fine-tuning needs its own assessment of training data, memorisation and rights requests. The EDPB's opinion on AI models explains that anonymity and lawful processing require a case-by-case assessment. Neither RAG nor fine-tuning establishes compliance by itself.

Make retention and transfers explicit

Specify retention separately for content, security records and backups. Verify what a provider's zero-retention commitment actually covers, including exclusions and connected services. Destroying a runtime is not proof that every copy has been erased.

Processing outside the EEA is not automatically prohibited. The applicable transfer mechanism and safeguards must be assessed; the Commission explains international transfer rules. Also review operational access, subprocessors and jurisdiction instead of assuming a corporate address resolves every access risk.

Turn the review into an implementation scope

Agree the permitted data, access rules, model use, review steps and evidence to retain. Test those controls with a defined workflow before expanding it. NeuroCluster's available controls and operating responsibilities are specified for each engagement; they do not replace the controller's legal assessment.

Sources and review date

Checked on 15 October 2026. Primary references: GDPR, the EDPB opinion and the Commission's transfer guidance linked above. For the separate AI Act assessment, see AI Act readiness.