## 2 Related Work
### The General Data Protection Regulation  
The General Data Protection Regulation (GDPR) [3] was enacted on 25 May 2018 by the European Union (EU) to harmonize data privacy laws across the EU. The GDPR regulates by law when and under what conditions data may be collected from individuals, what they may be used for, and what rights the data subject to whom the data belong has.  
The GDPR [3] is based on nine fundamental principles, which are summarized in Figure 2. These principles govern the lawful collection and processing of data. The first principle of _lawfulness_, _fairness_, _and transparency_ requires that data processing has a legal basis. Moreover, fair data processing involves handling personal data reasonably, avoiding unjustified harm, and considering the impact on individuals and groups. Transparent processing requires clear and honest communication from the start, ensuring individuals can make informed decisions about the handling of their data, even when collected indirectly. _Purpose limitation_ ensures that data are collected for specified, explicit, and lawful purposes and cannot be processed in a manner that violates these purposes. _Data minimization_ ensures that personal data should be limited to what is relevant in the given context. The _accuracy_ principle mandates that data should always be kept up to date, while _storage limitation_ enforces that personal data are kept in minimal quantities and only for the duration of their genuine necessity or legal mandate. _Integrity and confidentiality_ aim to guarantee the security of the processed data and to enforce the implementation of data security. The _accountability_ principle makes the data controller responsible and, therefore, accountable for compliance with the GDPR. _Privacy by design_ implies that privacy should be considered at every stage of product development. Finally, the default settings for online services should always minimize the processing of personal data, according to _privacy by default_.  
The GDPR grants individual rights to data subjects (see Figure 3). Data subjects have the right to be informed about the processing of their data by authorities and organizations. The right to access allows data subjects to obtain a copy of their stored data, while the right to erasure defines the different circumstances under which the data subject can force the deletion of its data. This corresponds to the right to objection, which allows data subjects to stop the processing of their data. The right to restrict processing allows data subjects to request that their data be restricted or suppressed. In addition, the right to rectification allows data subjects to have their data corrected or completed. Finally, the GDPR grants data subjects the right to data portability, which means that personal data can be easily transferred from one IT system to another.  
The principles and individual rights outlined above impose a responsibility on all those who access and process data to document their data protection measures and processing activities. This documentation consists of at least thirteen mandatory documents, which are defined in various articles of the GDPR. Key documents include the Personal Data Protection Policy, the Privacy Notice, the Employee Privacy Notice, the Data Retention Policy and Schedule, the Data Subject Consent Form, the Parental Consent Form, and the DPIA Register. Additionally, documents, such as the Supplier Data Processing Agreement, and various data breach responses and notification forms, are required.  
With the stringent requirements of the GDPR, there is a growing need for tools to support regulatory compliance. Recent advancements in LLMs offer promising applications for complex legal tasks as needed for GDPR compliance. The next section explores research on tasks for LLMs in the legal domain.  
Figure 3: The rights of individuals concerning their personal data as set in the GDPR.  
Figure 2: The principles of personal data protection as set in the GDPR.