Key Takeaways
- DeepSeek API is highest-risk: servers are subject to Chinese data-access law (PIPL), there is no EU adequacy decision for China, and the ToS explicitly allows data sharing with Chinese authorities
- Qwen 2.5 14B and Llama 4 Scout run locally are lowest-risk: no Article 44 transfer, no SCC required, data stays on your hardware
- Claude API and GPT-5.5 Instant are medium-risk: US jurisdiction requires Standard Contractual Clauses + Transfer Impact Assessment; EU-data-residency options (Claude EU) reduce risk
- Recommended stacks: startups (Claude + SCC), data-sensitive orgs (Qwen 24 GB local), enterprises (multi-GPU Qwen + air-gap)
- Risk decision matrix covers five vectors: data residency, training-data jurisdiction, ToS data retention, SCC requirement, and legal verdict
Four GDPR Risk Vectors for LLMs
Not all LLM deployments carry the same GDPR risk. The legal and operational risk of using an LLM is determined by four independent factors:
Risk Matrix: Model-by-Model Comparison
The table below summarizes the GDPR risk profile of each deployment option. Higher scores indicate higher legal and operational risk.
Per-Model Verdict and Recommended Use
Use this section to understand when each deployment is appropriate for your GDPR compliance posture.
Recommended Stack by Organization Type
The right LLM stack depends on your organization's data sensitivity, budget, and regulatory posture. Use these recommendations as a starting point for procurement decisions.
Is DeepSeek GDPR compliant if I use it with an SCC?
No. SCCs alone do not satisfy GDPR Article 44 transfers to mainland China because: (1) there is no EU-China adequacy decision post-Schrems II; (2) Chinese law (PIPL) mandates that companies share data with state authorities on request, which SCCs cannot override; (3) Anthropic, OpenAI, and other major vendors do not offer SCC enforcement in China—they refuse to operate there. For any personal data of EU residents, do not use DeepSeek API. If you need DeepSeek, use the local weights (run `ollama run deepseek-coder:latest` on your hardware).
Does using Claude EU with SCC satisfy GDPR?
Mostly yes, with caveats. Claude EU keeps your data in Ireland or Germany during processing and deletes it within 30 days. Anthropic has published a GDPR-compliant DPA and SCC. However, Claude models were trained on US-based data, and Anthropic is a US company, so technically there is still a "transfer" in the form of model training and vendor relationship. For practical compliance, Claude EU + SCC is acceptable for most organizations. For the absolute strongest posture (no transfer risk at all), use local Qwen or Llama.
Can I use Llama 4 Scout as a drop-in replacement for Claude?
For GDPR compliance: yes. Llama 4 Scout is open-source and can run locally, so it satisfies Articles 44, 25, and 32 fully. For capability and performance: maybe. Llama 4 Scout is smaller (8 GB VRAM) than Claude (which is proprietary and very large), so it is faster and cheaper to run locally, but may be less capable on some benchmarks. Test on your workload first. For simple Q&A, summarization, and code tasks, Llama 4 Scout is competitive. For very complex reasoning, Claude is still better, but local Qwen 2.5 14B or Llama 3.2 70B can handle most enterprise tasks.
What happens if I log my prompts locally for audit purposes?
Logging is encouraged for Article 30 compliance. Log the following: model name, session timestamp, input token count, output token count, and a SHA-256 hash of the prompt and response. Do NOT log the raw text of prompts containing personal data. Hash-based logging satisfies Article 30 (processing records) and Article 32 (security) without violating Article 5(1)(e) (storage limitation). Store logs on an encrypted, access-controlled system (e.g., log aggregation server with role-based access). Retain logs for 3 years per DPA standard.
Is running an LLM on-prem more expensive than cloud APIs?
Upfront: yes. Hardware (RTX 4070 Ti) costs ~$500–1000. Monthly: no. On-prem electricity is ~$5–10/month. Cloud APIs cost $0.001–0.01 per 1K tokens, which for heavy usage (>1M tokens/month) exceeds $100. Break-even is typically 6–12 months for medium-to-heavy usage. If you run <100K tokens/month, cloud APIs are cheaper. If you run >1M tokens/month, on-prem is cheaper. GDPR compliance is an additional business case: on-prem means zero SCC/TIA legal cost.