GDPR-Compliant LLM APIs: A Practical Guide for EU Builders

"GDPR-compliant" is the most abused phrase in AI. A provider can claim it while still retaining your prompts for 30 days, training on non-enterprise tiers, or routing your data through sub-processors in three different jurisdictions. Here's how to actually evaluate a model provider for EU compliance.

The retention question is the whole game

Under GDPR, the controller (you) is responsible for what your processors do with personal data. If an LLM provider logs prompts and completions — even "anonymized" — you inherit that exposure. Evaluate the gateway and every upstream processor separately; a gateway's prompt-retention policy is not an end-to-end claim.

• Gateway prompt retention describes whether the gateway persists prompts or completions; confirm upstream terms independently.
• Ephemeral memory means context lives only for the duration of the request.
• "We retain 30 days" is a red flag if you're handling personal data — that's data storage, full stop.

Sub-processors and data residency

Most "private" offerings are actually resellers of a US hyperscaler. Your data still crosses borders, and you may have no visibility into where it's processed. For EU builders, the practical asks are:

• Who are the actual compute providers, and in which jurisdictions?
• Is there a written no-training commitment?
• Is there a DPA, and does it match the retention terms for each processor?

An onshore or regional data path — say, Australian or EU-hosted compute — shortens the compliance argument dramatically versus a US round-trip.

The compliance checklist

Before you wire a model into a product handling personal data, confirm:

• Gateway and upstream retention policies are documented in writing, not just in marketing.
• No training on your traffic on any tier you use.
• Clear sub-processor list and a residency story that survives an audit.
• A no-military / ethical-use policy if your procurement requires it.

If a provider can't answer all four in one sentence each, keep looking.

The takeaway

GDPR compliance for an LLM API isn't a checkbox — it depends on retention architecture, residency, contracts, and the actual processor chain. Those are the details that survive a serious procurement review.