## 6 Conclusions  
This study explored the potential of LLMs, particularly open-source models such as Qwen2-7B, for automating GDPR compliance tasks, such as generating data categories for processing activity records. By demonstrating performance comparable to GPT-4 in structured scenarios, Qwen2-7B highlighted the feasibility of cost-effective, privacy-preserving alternatives to proprietary systems. Open-source models can more fully meet the strict data security requirements under GDPR, with the added benefit of supporting local deployment for better organizational control over sensitive information.  
This study contributes to the growing field of AI in legal technology by validating the applicability of LLMs in compliance workflows. These models can automate repetitive work, such as the development of initial documentation, enabling human experts to focus their energy on higher-order decision-making. For practitioners, this underlines the need for the incorporation of safeguards such as validation pipelines, transparency regarding training data, and human review in iterations to secure outputs that meet both regulatory and ethical standards. While RAG and fine-tuned embeddings present opportunities for improving the adaptability and accuracy of these models, their implementations will require scalability, latency, and ambiguous legal context challenges to be overcome.  
However, the study also identified critical limitations. The concentration on data category generation itself restricts generalizability to other tasks in GDPR, such as privacy impact assessments or consent management. Furthermore, reliance on pre-specified benchmarks risks failing to capture the nuances and constantly changing nature of real-world compliance scenarios. This indeed calls for more extended evaluation frameworks. Future work should pursue domain-specific fine-tuning, human evaluation, and applications for a wide range of regulatory contexts, such as the California Consumer Privacy Act (CCPA) [40], to extend the value of LLMs in legal compliance.  
The ethical and legal consequences of using LLMs in such sensitive domains as regulatory compliance also call for further discussion. Among the questions that remain open is that of bias in pretraining data, accountability in automated decisions, and compliance with GDPR principles of transparency. For practitioners, it is important to have more specific implementation guidelines to close the gap between theoretical feasibility and operational deployment. With these challenges overcome, LLMs in future research can become robust, scalable tools that balance cost-effectiveness, privacy, and ethical considerations, thus transforming the landscape of compliance-driven applications.  
[PERSON] wrote the paper. [PERSON] corrected and supervised this work. All authors have read and agreed to the published version of the manuscript. This research received no external funding.  
Data Availability Statement: The original data presented in the study are openly available on GitHub at [[https://github.com/magdalenavonschwerin/llms-in-gdpr-documentation](https://github.com/magdalenavonschwerin/llms-in-gdpr-documentation)]([https://github.com/magdalenavonschwerin/llms-in-gdpr-documentation](https://github.com/magdalenavonschwerin/llms-in-gdpr-documentation)) (accessed on 18 November 2024).