## 3 Methodology
### LLM Selection  
We present a selection of prominent state-of-the-art LLMs chosen for our experiments and outline the criteria for their selection. To establish a baseline for high-quality general text generation, the study included GPT-4, a closed-source model from OpenAI. This selection was based on its performance on prominent general benchmarks [20]. For comparison, four open-source models were selected based on five main factors. 1. Pretraining. Pretraining allows LLMs to learn broad language patterns, vocabulary, and basic factual knowledge by analyzing large, diverse textual datasets [21]. This foundational knowledge is essential for recognizing legal terminology for tasks in regulatory contexts, such as the GDPR. Instruction-tuning refines these skills by teaching the model to follow specific task instructions [22]. This improves the ability to generate structured and contextual responses. This is particularly important for legal tasks, for which precision in format and terminology becomes crucial, as it aligns the model output with structured prompts typical of GDPR documentation requirements. 2. Local deployment. Models should be deployable to local machines, as this keeps sensitive data in a controlled environment and ensures privacy, which is essential for GDPR compliance. Moreover, this setup prevents data from being exposed to third-party servers, reducing the risk of unauthorized access and interception. 3. Size. To ensure applicability and usability on consumer hardware (NVIDIA 3090 GPU), models were limited to 8 billion parameters. 4. License. The models should have a permissive license such as Apache 2.0 [23] or MIT [24] to make them easy to use in smaller organizations. Quantitative evaluation. The models were evaluated based on the HuggingFace open-llm-leaderboard [25], which ranks and presents LLMs based on their performance on established benchmark tasks. It provides a central hub for researchers and practitioners to compare and evaluate the capabilities of different LLMs in various applications. It comprises five main benchmarks: IFEval (Instruction-Following Evaluation) [26], BBH (Big-Bench Hard)[27], GPQA (Graduate-Level Google-Proof QA Benchmark) [28], MUSR (Multistep Soft Reasoning)[29], and MMLU-PRO [30]. These benchmarks reflect skills such as following instructions, reasoning, and problem solving. As such, they are highly relevant to the selection of LLMs for GDPR compliance roles, as they provide insight into the handling of structured, nuanced prompts and complex reasoning, which are both essential for accurate legal and regulatory responses. Our selection, presented in Table 1, was mainly based on the open-llm-leaderboard scores [25]. We chose four models backed by renowned tech companies and leaders in AI technology such as Meta, Alibaba, and HuggingFace. All selected models were pretrained and followed instructions well. These models were also available in smaller versions for local deployment on consumer-grade hardware via HuggingFace, with permissive licenses that allowed for their flexible use in different organizational environments. While the five criteria provided a robust foundation for model selection, we acknowledge some limitations. For instance, relying on general-purpose benchmarks such as IFEval and GPQA did not fully capture the nuances of legal reasoning or the specific requirements of regulatory compliance. Additionally, limiting models to 8 billion parameters excluded larger models that might have shown superior performance but required more extensive computational resources. Factors such as interpretability, cost-effectiveness, and fine-tuning for specific legal domains were also considered but not prioritized in this study. Our focus was to evaluate model accuracy and feasible deployment in privacy-compliant environments. Future research could explore these aspects further and incorporate specialized legal benchmarks to complement the general-purpose metrics used here.