Guide · Privacy & compliance
Can you send customer data to an LLM? Usually yes — if you do these things first.
Sending personal data to a hosted model is not automatically illegal, and it’s not automatically fine. Under GDPR it’s processing like any other: you need a legal basis, a proper contract with the provider, a lawful route for any transfer outside the EU, and a design that sends no more data than necessary. Here is the practical checklist.
By Nythrex EngineeringUpdated 4 min read
- 01
Your app
Collects customer data
- 02
Minimise
Redact · pseudonymise
- 03
AI service
Your cloud · logs & access control
- 04
Model provider
DPA · region · retention terms
- 05
Response
Filter output · store only what’s needed
The six questions to answer
- 1
1. What personal data actually reaches the model?
Map it: names, emails, order history, free-text messages (which contain anything customers write), attachments. Free text is the hard part — customers paste IDs, health details and passwords.
- 2
2. What’s your legal basis — and does AI fit the original purpose?
If you process support tickets under contract performance, using AI to help answer them is usually closer to the original purpose than, say, using them to train a new product. Document your reasoning.
- 3
3. Is the provider bound by a DPA?
Major AI providers offer data processing terms for business customers. Check what’s included, the list of sub-processors, and security commitments.
- 4
4. Where is data processed and stored?
Several providers and cloud platforms offer EU data-residency or regional deployments. If data leaves the EEA, you need a transfer mechanism — for example, the EU–US Data Privacy Framework for certified US companies, or standard contractual clauses.
- 5
5. Is data used for training, and how long is it kept?
Most major providers state that business API data isn’t used for training by default, and many keep inputs for a limited period for abuse monitoring — with options to reduce retention for eligible customers. Verify the current terms for the exact product and tier you use.
- 6
6. Do you need a DPIA?
If processing is likely to result in high risk — large-scale sensitive data, systematic monitoring, automated decisions with significant effects — a data protection impact assessment is required. Many AI use cases in HR, finance or health fall into this area.
Privacy by design: patterns we use
| Pattern | What it does |
|---|---|
| PII redaction before the model | Detect and mask names, emails, phone numbers, IDs; restore them in the response only where needed |
| Pseudonymisation | Replace customer identifiers with tokens; the mapping stays in your system |
| Retrieval with permissions | The model only sees documents the user is allowed to see |
| Regional deployment | Model endpoints and data stores in the EU (or your required region) |
| Minimal logging | Log what you need for quality and audit, with retention limits and access control |
| Self-hosted models | For the strictest cases, open-weight models on your infrastructure — no third-party processor |
And the EU AI Act?
GDPR governs personal data; the AI Act governs AI systems by risk level. They apply side by side. Most customer-support or document AI isn’t high-risk under the AI Act, but transparency duties (for example, telling people they’re talking to an AI) can apply. See EU AI Act for product teams.
Checklist before go-live
Frequently asked questions
Keep reading
Want a second opinion on your project?
Tell us what you’re building and where you’re stuck. We’ll reply within one business day with the most practical next step — even if that step isn’t us.