## 2 Related Work
### LLMs in the Legal Domain  
Current research has identified several key tasks for automation through an LLM in the legal domain [2]. The THIUR team [7] developed a specialized LLM for _legal case retrieval_. This task involves retrieving cases from a large legal database of historical cases similar to a specified query case. _Legal judgment prediction_ aims to use LLMs to improve fair reasoning and efficiency in legal processes [2]. Furthermore, LLMs are trained for _legal question answering_ to provide complex legal information to the general public in an understandable format. Significant contributions in this area include fine-tuned LLMs on legal Q&A datasets, such as Lawyer Llama [8] and Lawyer GPT [9]. However, while Lawyer Llama and Lawyer GPT demonstrate the potential for legal question answering, their fine-tuning on general legal Q&A datasets limits their ability to address highly specific tasks such as GDPR compliance. These models perform well in recalling legal knowledge, but might lack the structured output necessary to generate compliance documentation. [PERSON] et al. [10] evaluated LLMs for _semantic annotation_, demonstrating that GPT-4 performed well in labeling parts of legal documents such as contracts. However, the study primarily focused on the model's ability to categorize existing content, rather than its capacity to generate new content or adhere to regulatory requirements such as those outlined in the GDPR. This limits its applicability to compliance tasks, where precise generation and structured outputs are critical. _Document drafting_ represents another labor-intensive legal task explored by [PERSON] et al. [11]. The authors created a dataset to evaluate how effectively LLMs understood and executed detailed instructions in the drafting process. Their results showed that while LLMs performed well with complex tasks, they struggled with nuanced instructions requiring a deep contextual understanding. This limitation is particularly relevant for GDPR compliance, where generating structured domain-specific documentation requires not only linguistic accuracy, but also strict adherence to legal standards and terminologies. These challenges highlight a key gap in current research: _the ability of LLMs to generate outputs tailored to the structured requirements of legal and regulatory documents, an area that this study aims to address_. This study investigates how effectively LLMs can support GDPR-specific drafting needs. There are currently no other studies on LLMs for drafting documents in the context of GDPR compliance. However, other application areas for LLMs in GDPR compliance have been explored in recent work. [PERSON] et al. [12] studied the completeness checking of Data Processing Agreements, a document required by the GDPR for international data transfers. They compared different LLMs on over 31,000 sentences, labeled to indicate whether each sentence complied with specific GDPR provisions. Here, LLMs performed well, achieving an F2 score of 89%. Although [PERSON] et al. provided promising results for completeness checking of Data Processing Agreements based on LLMs, their study did not address the generation of other critical GDPR compliance documents. Moreover, the reliance on pre-labeled datasets and on a static set of GDPR provisions limits the applicability of the models in evolving compliance contexts. The work presented in [13] assessed LLM compliance with the GDPR in a series of experiments using sensitive medical data. The results of that work demonstrated that LLMs were highly susceptible to retaining and copying sensitive personal information from their input. This suggests that locally hosted open-source models are crucial for the legal domain, so that no data can be processed further by third parties. These models ensure compliance with GDPR principles like data minimization and storage limitation (Art. 5 GDPR [3]) by maintaining full control over data processing.