## 5 Discussion  
In this section, we discuss our findings in relation to the research questions (RQs) and their implications for practice. We set the focus on the utility of LLMs in document drafting for GDPR compliance.  
\begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Model** & **Exp 1** & **Exp 2** & **Exp 3** & **Exp 4** & **MC Bench** & **Gen Bench** & **Utility** \\ \hline
**Qwen2-7B** & 75 & 63 & 71 & 62 & 25 & 15 & **107.75** \\
**Meta-Llama-3-8B** & 66 & 65.5 & 56.5 & 47 & 15 & 15 & **88.75** \\
**zephyr-7b-beta** & 73 & 74 & 59 & 65 & 15 & 5 & **87.75** \\
**orca_mini_v7_7b** & 71 & 66 & 66 & 58 & 25 & 5 & **95.25** \\
**GPT-4** & 70 & 66 & 67.5 & 61 & 25 & 15 & **106.125** \\ \hline \hline \end{tabular}
\end{table}
Table 6: Weighted scores per model in each experiment and benchmark.  
Figure 9: Overall utility scores per model. The score consists of the experiment score, multiple-choice benchmark score, and the generation benchmark score.  
RQ1: Can open-source LLMs generate data categories for GDPR compliance documentation as effectively as GPT-4?  
Our results show that open-source models, especially Qwen2-7B, are viable alternatives to closed models like GPT-4 for drafting GDPR documents. Allowing local deployment, open-source models increase the compliance of GDPR data transfer rules and give more control over sensitive data. This is important for small enterprises, where cost savings from reduced reliance on proprietary systems can balance initial deployment investments.  
At the same time, deploying LLMs for compliance is fraught with challenges. The level of customization required to make models organization-specific and adapt to regional regulatory nuances is too high for smaller organizations. Furthermore, pretrained models with opaque datasets raise questions about biased outputs and a potential conflict with the accountability and transparency principles of the GDPR. Ensuring the outputs meet organizational needs will require careful integration with existing workflows and regulatory requirements, emphasizing the importance of adaptability and operational feasibility.  
**RQ2: To what extent do context-augmenting techniques such as few-shot prompting and Retrieval Augmented Generation (RAG) enhance LLM performance in drafting documents for GDPR compliance?**  
The experiments show mixed results for context augmentation techniques. Few-shot prompting yielded limited improvements, indicating that prompt design alone may not be sufficient for complex legal tasks. However, it is still a promising tool for aligning models with specific formatting requirements without retraining, particularly when combined with curated sample prompts reflecting real-world GDPR documentation.  
While RAG was effective in retrieving results for predefined categories, it struggled with novel or ambiguous queries due to its reliance on static resources like the GDPR document. Moreover, the fact that RAG relies on predefined text sources, such as the GDPR document itself, points to a larger problem: the semantic gap between the formal legal language and user-specific queries. This gap limits the ability of retrieval models to generate outputs that are directly actionable without significant human intervention. Addressing these limitations will require dynamic updates to the resource database, fine-tuned embeddings for legal contexts, and hybrid retrieval methods combining semantic search with symbolic reasoning. Apart from these improvements, merging RAG with dynamic knowledge graphs, which evolve over time, could overcome some of the limitations of static retrieval systems. Such knowledge graphs may become more adaptive and relevant to changes in regulation or organizational policy, thus making outputs better suited for compliance tasks in an evolving context.