# GDPR and Large Language Models: Technical and Legal Obstacles
## 3 General Challenges and Considerations
### Technological Limitations vs. Legal Requirements  
There exists a significant gap between the technical capabilities of LLMs and the stringent legal requirements set forth by GDPR. On one hand, LLMs are capable of processing vast amounts of data through complex, often opaque methodologies [1]. On the other hand, current regulatory frameworks are not always agile enough to address the rapid evolution of AI technologies, creating challenges for compliance and enforcement.  
Bridging this gap requires collective action. Collaboration among technologists, legal experts, and policymakers is essential to develop adaptable frameworks that can keeppace with advancements in AI [1]. Regulations must be designed to be flexible and evolve alongside emerging technologies, while continuous research should be supported to devise new techniques and methodologies that enhance GDPR compliance in the context of evolving AI capabilities [71]. Balancing technological innovation with robust data protection principles is crucial to ensure that LLMs adhere to the core tenets of GDPR.  
**Utility vs. Compliance Trade-Offs.** Achieving GDPR compliance often comes at the expense of model utility. For instance, training with differential privacy (DP) guarantees typically incurs some accuracy loss--[PERSON] et al. highlighted that differential privacy significantly impacts model accuracy, especially harming performance on underrepresented classes [81]. Empirical studies confirm this trade-off: DP-SGD can moderately reduce performance under intermediate privacy budgets (e.g., a noticeable drop in accuracy or BLEU score at \(\epsilon\approx 3\)[81]), while stricter privacy budgets substantially amplify this effect. [PERSON] et al. demonstrated that strong DP noise (\(\epsilon=8\)) applied to language models severely limited BLEU scores to around 24, compared to a baseline of 63 achieved by pre-training on public data before private fine-tuning [82].  
Similarly, modular or isolated architectures designed for efficient machine unlearning expedite data removal processes but may disrupt global model coherence. [PERSON] et al. proposed a modular machine unlearning framework that accelerates compliance with deletion requests, achieving approximately 4\(\times\) faster updates compared to full retraining [31]. In vision benchmarks, [PERSON] et al. further illustrated that boundary-based modular unlearning can deliver substantial efficiency gains, reporting speedups of up to 17\(\times\)[83]. However, these methods can slightly degrade overall accuracy due to the compartmentalization of training data or model parameters, potentially limiting context integration [31].  
This trade-off is not only technical but also economic. [PERSON] et al. noted that fully retraining or fine-tuning models for individual erasure requests is often prohibitively expensive, with modern models requiring weeks of compute time and resources valued in the millions [82]. Additionally, storing multiple model versions to address individual data removal requests significantly increases storage costs [82]. Consequently, organizations must carefully weigh the benefits of high-performing, context-rich models against the legal and ethical imperatives of robust data protection, balancing privacy methods applied during training (e.g., DP) against on-demand modular unlearning mechanisms.