Trust and compliance · 2026-09-08
How to Choose a GDPR-Compliant LLM API: A Developer Checklist
Learn which questions to ask when selecting a GDPR-compliant LLM API, how to separate a provider statement from verifiable fact, and what an engineering team can check on its own.
What a GDPR-compliant LLM API is, and is not
An API is not compliant or non-compliant in itself; your processing activity is. Choosing a provider is one part of that activity, and the useful question is whether using this provider lets you meet your obligations as a controller.
In practice that means four pieces of information have to be obtainable: where data is processed, which sub-processors are involved, whether inputs are retained or used for training, and which of those are contractually committed rather than merely described. Without all four there is nothing to assess, and a badge on a marketing page does not fill the gap.
Separate what is stated from what is verified
A provider statement is not worthless; once it is in a contract it has legal consequences. But a statement is not a measurement. A platform saying it runs its models in Europe and you having verified that are different things, and an honest vendor does not close that gap on your behalf.
For the models in this category, processing inside the European Union is what the provider states; LLMTR has not independently verified it. Keep the same distinction in your own assessment: record separately which item is a statement, which is a contractual commitment and which is an independent audit report.
Concrete checks an engineering team can run
Legal assessment runs on documents, but there are things an engineering team can look at without waiting. They do not prove compliance; they show where a statement and reality have come apart, and those gaps are the expensive surprises.
One example we measured: a provider's model card listed two models as image-capable, and in testing those models never processed an image at all. Had the capability list been copied, callers would have paid for images that were thrown away. Apply the same scepticism to data-handling claims.
- Compare the provider's published sub-processor list against what its own API reports, and ask in writing when they disagree.
- Look for retention terms in the contract, not in a blog post.
- Establish how deletion and portability requests are handled, and within what period.
- Check whether you are entitled to advance notice of a sub-processor change.
Where this information sits on LLMTR
The catalog's European Union filter lists this category on its own, and every model page carries a short data policy note attributing the claim to the provider. The category page brings together what the provider states, the fact that request content is transferred to it, and the consent you have to approve in Settings before that happens.
The open point is stated rather than hidden: the provider's pricing endpoint names five sub-processors running the models, while its published data-location page lists two of them. We have asked which country the remaining two are in and are waiting for an answer. If you are running a compliance assessment, put that item in your own risk register.
Frequently asked questions
Can a certificate prove that an LLM API is GDPR compliant?
There is no single mandatory certification scheme for GDPR. Documents such as ISO 27001 or SOC 2 tell you about security management but do not on their own establish that your processing activity is lawful. The assessment rests on your purpose and legal basis.
If the models run in Europe, does the transfer question disappear?
No. Processing inside the EU reduces the third-country transfer question, but support access, logging and the sub-processor chain each need separate assessment. The source of the residency information also matters: a provider statement, a contractual commitment and an independent report are not equivalent.
How can I be sure my inputs are not used for model training?
You cannot verify this from the outside; it has to be contractual. Check whether the provider commits to it in the data processing agreement, and establish what follows if the commitment is broken.