# GDPR and Large Language Models: Technical and Legal Obstacles
## 1 Introduction  
### Background on GDPR  
The General Data Protection Regulation (GDPR), officially Regulation (EU) 2016/679, is a comprehensive data protection law that came into effect on 25 May 2018. It was established by the European Union (EU) to strengthen and unify data protection for all individuals within the EU and the European Economic Area (EEA) [1]. Moreover, the GDPR addresses the export of personal data outside the EU and EEA regions, thereby extending its reach globally due to its extraterritorial applicability [2]. More specifically,Article 3 [3] of the GDPR defines its territorial scope, significantly extending the reach of EU data protection law beyond its borders. This has critical implications for the global development and deployment of large language models (LLMs), which often process vast amounts of personal data across jurisdictions. The Regulation applies under the \"establishment\" criterion when a data controller or processor operates within the EU and under the \"targeting\" criterion when non-EU organizations offer goods or services to individuals in the EU or monitor their behavior. Even companies with no physical presence in the EU may still fall within the GDPR's scope if their activities involve EU individuals, and the Regulation further applies where Member State law is relevant under public international law. Given the cross-border nature of AI and LLMs, the GDPR is a crucial regulatory framework in shaping global AI governance. The primary objectives of the GDPR are to give individuals control over their personal data, simplify the regulatory environment for international business by unifying data protection within the EU, and enhance organizational accountability for data protection [4]. Its key principles require that personal data is processed lawfully, fairly, and transparently; that data is collected for specified, explicit, and legitimate purposes; that only the data necessary for those purposes is processed (data minimization); that personal data is accurate and kept up to date; that data is stored only as long as necessary; and that all processing is carried out securely, with the data controller being accountable for ensuring compliance [5]. In addition, the GDPR grants several rights to individuals (data subjects). These rights include the Right of Access (Article 15) [6], which allows individuals to obtain confirmation of whether their personal data is being processed and to access that data along with information about its processing; the Right to Rectification (Article 16) [7], which enables individuals to correct inaccurate personal data; the Right to Erasure, or \"Right to be Forgotten\" (Article 17) [8], which permits individuals to request the deletion of their personal data under certain conditions; the Right to Restrict Processing (Article 18) [9], which allows individuals to request limitations on how their data is processed; the Right to Data Portability (Article 20) [10], which gives individuals the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller; the Right to Object (Article 21) [11], which enables individuals to object to the processing of their personal data for certain purposes such as direct marketing; and the Rights Related to Automated Decision-Making (Article 22) [12], which protect individuals from decisions based solely on automated processing, including profiling, that have legal or similarly significant effects. Organizations (both data controllers and processors) are obligated to implement appropriate technical and organizational measures to ensure and demonstrate compliance with the GDPR. This includes, among other measures, conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities (Article 35) [13], appointing Data Protection Officers (DPOs) in certain cases (Articles 37-39) [14; 15; 16], and adhering to the principles of data protection by design and by default (Article 25) [17].