# GDPR and Large Language Models: Technical and Legal Obstacles
## 4 Discussion
They can also opt for modular architectures that allow specific segments of data to be selectively unlearned in response to erasure requests, reducing the need for retraining entire large-scale models. Federated learning, when appropriate, helps keep personal data on local devices rather than centralizing it, and encrypted training methods protect raw data against unauthorized disclosures. Furthermore, output filters and policy enforcement mechanisms can be implemented to prevent the inadvertent leakage of personal data in generated outputs. Because LLMs evolve over time--either by ingesting new data or through model updates--the third layer, \"Continuous Compliance Monitoring\", ensures that privacy and compliance obligations are not seen as a one-time project but rather an ongoing effort. Automated systems for data protection impact assessments (DPIAs) and risk analyses can detect emerging threats as the model changes. Regular auditing of training logs, inference requests, and unlearning operations helps verify that privacy measures are functioning as intended. In addition, targeted retraining protocols allow developers to respond efficiently to specific requests for erasure or rectification. If a data subject wishes to remove their personal data from the model, well-defined retraining or unlearning methods can be applied to address that need without unduly disrupting the model's functionality. This continuous monitoring framework extends to incident response plans that align with GDPR's breach notification requirements, ensuring swift containment and remediation of any data leak or privacy lapse. Finally, the fourth layer, \"Explainability and Oversight\", targets the transparency of the model's decisions and the establishment of human review for high-stakes scenarios. Because LLMs can act as black boxes, it is crucial to incorporate techniques for interpretability, such as saliency mappings or model distillation, that provide insight into how certain inputs affect outputs. In settings like finance, healthcare, or legal decision-making, there should be a mandatory human-in-the-loop stage to fulfill the GDPR requirement of allowing data subjects to contest automated decisions that have significant effects on them. This layer also involves publishing periodic transparency reports, informing stakeholders about model performance, known biases, and any privacy incidents. In addition, audits focusing on fairness and bias can help detect and mitigate discriminatory outcomes, thus upholding GDPR's principle of non-discrimination and fostering public trust. Taken together, these four layers operate in tandem to deliver a comprehensive governance model for GDPR-aligned LLM development. By embedding privacy controls throughout the entire lifecycle, developers can more effectively manage evolving legal obligations, particularly in high-risk application domains, and demonstrate a proactive approach to safeguarding individual rights. This end-to-end framework helps to meet the complexities of personal data definitions, legitimate interests, and unlearning feasibility, thereby supporting a \"GDPR-first\" culture of compliance that remains sensitive to the unique challenges posed by large-scale AI systems. As shown in Figure 4, our proposed governance framework divides LLM compliance into four interconnected layers. The first layer focuses on data governance practices and lawful bases for data collection, ensuring that all personal information is gathered under appropriate conditions and thoroughly documented. Building on this foundation, the second layer deploys technical mechanisms such as differential privacy and modular unlearning to safeguard personal data throughout the model's training and inference stages. The third layer underscores the importance of continuous monitoring through regular audits, automated risk analyses, and protocols for retraining or incident response in alignment with GDPR.