Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
GDPR and Large Language Models: Technical and Legal Obstacles
Stockholm University, Faculty of Social Sciences, Department of Psychology, Stress Research Institute. Stockholm University, Faculty of Social Sciences, Department of Statistics.ORCID iD: 0000-0001-9910-1132
Show others and affiliations
Number of Authors: 62025 (English)In: Future Internet, E-ISSN 1999-5903, Vol. 17, no 4, article id 151Article in journal (Refereed) Published
Abstract [en]

Large Language Models (LLMs) have revolutionized natural language processing but present significant technical and legal challenges when confronted with the General Data Protection Regulation (GDPR). This paper examines the complexities involved in reconciling the design and operation of LLMs with GDPR requirements. In particular, we analyze how key GDPR provisions—including the Right to Erasure, Right of Access, Right to Rectification, and restrictions on Automated Decision-Making—are challenged by the opaque and distributed nature of LLMs. We discuss issues such as the transformation of personal data into non-interpretable model parameters, difficulties in ensuring transparency and accountability, and the risks of bias and data over-collection. Moreover, the paper explores potential technical solutions such as machine unlearning, explainable AI (XAI), differential privacy, and federated learning, alongside strategies for embedding privacy-by-design principles and automated compliance tools into LLM development. The analysis is further enriched by considering the implications of emerging regulations like the EU’s Artificial Intelligence Act. In addition, we propose a four-layer governance framework that addresses data governance, technical privacy enhancements, continuous compliance monitoring, and explainability and oversight, thereby offering a practical roadmap for GDPR alignment in LLM systems. Through this comprehensive examination, we aim to bridge the gap between the technical capabilities of LLMs and the stringent data protection standards mandated by GDPR, ultimately contributing to more responsible and ethical AI practices.

Place, publisher, year, edition, pages
2025. Vol. 17, no 4, article id 151
Keywords [en]
AI, AI Act, artificial intelligence, data privacy, GDPR, large language models, Legal Obstacles, LLM, LLMs
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:su:diva-242982DOI: 10.3390/fi17040151ISI: 001474998600001Scopus ID: 2-s2.0-105003460016OAI: oai:DiVA.org:su-242982DiVA, id: diva2:1956871
Available from: 2025-05-07 Created: 2025-05-07 Last updated: 2025-05-07Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Peristera, Paraskevi

Search in DiVA

By author/editor
Peristera, Paraskevi
By organisation
Stress Research InstituteDepartment of Statistics
In the same journal
Future Internet
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 91 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf