GDPR, the CNPD and AI: the transfer that isn’t there
Every prompt that carries personal data to a model hosted outside the EU is a Chapter V transfer, with the legal basis, transfer-impact assessment and supplementary measures that implies. The simplest way to satisfy Chapter V is not to trigger it.
Where the transfer hides
A prompt that includes a client name, an employee’s file or a counterparty’s bank details is personal data. If the model runs on a provider’s infrastructure outside the EEA — or with a US-controlled provider, wherever the servers are — sending it is a transfer. After Schrems II that means a transfer-impact assessment, standard contractual clauses or an adequacy decision, and supplementary measures where the destination’s law falls short.
Most firms discover the problem only when the DPO asks for the record of processing and the answer includes an AI vendor nobody had assessed.
What the CNPD expects
The CNPD applies the GDPR and the Luxembourg law of 1 August 2018. It expects controllers to know what processing takes place, on what basis, where and by whom; to have an Article 28 processor agreement with any vendor that handles personal data; and to be able to answer data-subject requests — including erasure — which is hard once data has been used to improve a third party’s model.
Its published decisions show a consistent focus on transparency and on controllers being able to demonstrate control.
On-premise, the analysis collapses
When inference runs on hardware you own, inside your network, there is no transfer, no processor and no third-party model to explain. The processing stays inside your existing controllership, the record of processing gains one line — internal document analysis — and erasure means deleting from your own index.
Retrieval-only design matters here too: the model answers from your documents without being trained on them, so nothing personal is baked into weights you cannot inspect.
Engineering guidance, not legal advice. We work alongside your DPO and counsel.
Official sources
Relevant sectors
See it on your own documents.
Thirty minutes on your use case, against a sample of your kind of files. We come to you.