Put an LLM in front of employees and, sooner or later, personal data goes through it, in prompts, in retrieved documents, in generated drafts. That makes the deployment a GDPR matter, whoever hosts it. But the conversation with your DPO goes very differently depending on where the model runs. Here are the questions that come up, and how self-hosting changes the answers.
“Where does the data go, and who is processing it?”
With cloud AI this question spawns a diagram: your organisation (controller), the AI vendor (processor), their infrastructure provider (sub-processor), possibly a transfer mechanism if anything touches a third country. Each hop needs contracts, assessment and monitoring.
With a self-hosted deployment the diagram collapses: the data goes to a machine you own, processed by software you operate. There is no processor for the inference step, no sub-processor chain, no international transfer. Whole categories of GDPR homework, DPAs for the AI vendor, transfer impact assessments, sub-processor change notifications, simply don't arise for the core processing.
“What's our lawful basis, and did we minimise?”
Hosting doesn't change this one: you still need a lawful basis (typically legitimate interests for internal productivity tooling, with a documented balancing test) and you still need data-minimisation discipline. What helps in practice is control at the gateway: DLP rules that stop obvious over-sharing (personnummer, card numbers, patient identifiers) before it reaches the model, and retention settings you define rather than inherit from a vendor's policy.
“Can we actually delete? What about the embeddings?”
The Article 17 question is where LLM deployments get genuinely technical. A person's data can live in five places: chat histories, uploaded documents, the vector index built from those documents (embeddings), any fine-tuned model trained on them, and backups. An honest erasure story has to reach all five.
Ask any AI vendor, including us, the same question: “When I delete a document, what happens to the vectors derived from it, and how long until backups age out?” If the answer isn't specific, the erasure story isn't real. On Kaldryn, erasure propagates across conversations, documents, embeddings, fine-tunes and backups, and the audit log records the propagation.
“Do we need a DPIA?”
Usually yes, and you should want one anyway, a DPIA is where the design decisions (what data the assistant can see, who can query what, retention, access) get made deliberately instead of by default. The EDPB's work on AI models (notably its Opinion 28/2024 on personal data in model training) is worth your DPO's time here; among other things it underlines that whether a model itself contains personal data is a case-by-case question. Self-hosting makes the mitigations section of the DPIA notably shorter: no third-party access, no transfers, physical control of the hardware.
“What do we tell employees?”
Transparency duties apply regardless of hosting: update your internal privacy notice, be clear about what's logged (admins can typically see usage), and set rules for what belongs in prompts. An internal AI-use policy plus the AI-literacy training you already owe under the AI Act covers most of it.
The short version for the steering meeting: GDPR applies either way, but self-hosting converts your hardest external-dependency questions into internal engineering questions, and internal engineering questions have answers you can verify.