FDEInterviews logo
← AI Security, Privacy & Governance / 17
mediumOpenAIAnthropicMicrosoft

Prompts and outputs contain personal data. What does GDPR mean for each call to an external LLM endpoint?

Every EU enterprise deal hits this question, and the FDE in the room is expected to carry it without legal on the call. The processor/controller split, the transfer mechanics, and the one GDPR right that's hard for LLMs.

Updated Aug 2026 · Grounded in real Forward Deployed Engineer interview loops and written to a senior-engineer editorial bar.

Every EU enterprise deal hits this question, and the FDE in the room is expected to carry it without legal on the call. The processor/controller split, the transfer mechanics, and the one GDPR right that's hard for LLMs.

more free answers with an account · no card
UP NEXT ON YOUR JOURNEY
Next in this trackThe customer asks: 'Will you train on our data?' Give the precise answer, and explain zero-data-retention.Next in this trackThe customer says 'our data can't leave our environment.' Walk me through the deployment options and what each really buys.Next in this trackA hospital wants an LLM feature over patient records. What does HIPAA actually require of your design?
DISCUSSION · 0

No comments yet — be the first to share your approach.