GDPR-Compliant LLM APIs: A Practical Guide for EU Builders

"GDPR-compliant" is the most abused phrase in AI. A provider can claim it while still retaining your prompts for 30 days, training on non-enterprise tiers, or routing your data through sub-processors in three different jurisdictions. Here's how to actually evaluate a model provider for EU compliance.

The retention question is the whole game

Under GDPR, the controller (you) is responsible for what your processors do with personal data. If your LLM provider logs prompts and completions — even "anonymized" — you inherit that exposure. The cleanest answer is zero retention: the request is processed, returned, and immediately forgotten.

• Zero-log / zero-retention means no prompt or completion is persisted after the response.
• Ephemeral memory means context lives only for the duration of the request.
• "We retain 30 days" is a red flag if you're handling personal data — that's data storage, full stop.

Sub-processors and data residency

Most "private" offerings are actually resellers of a US hyperscaler. Your data still crosses borders, and you may have no visibility into where it's processed. For EU builders, the practical asks are:

• Who are the actual compute providers, and in which jurisdictions?
• Is there a written no-training commitment?
• Is there a DPA, and does it match the zero-retention claim?

An onshore or regional data path — say, Australian or EU-hosted compute — shortens the compliance argument dramatically versus a US round-trip.

The compliance checklist

Before you wire a model into a product handling personal data, confirm:

• Retention policy is zero, in writing, not just in marketing.
• No training on your traffic on any tier you use.
• Clear sub-processor list and a residency story that survives an audit.
• A no-military / ethical-use policy if your procurement requires it.

If a provider can't answer all four in one sentence each, keep looking.

The takeaway

GDPR compliance for an LLM API isn't a checkbox — it's a retention architecture. Zero-log, zero-retention, onshore compute is the closest thing to a clean answer, and it's the only model that survives a serious procurement review.