GDPR and Large Language Models: Technical and Legal ObstaclesShow others and affiliations
Number of Authors: 62025 (English)In: Future Internet, E-ISSN 1999-5903, Vol. 17, no 4, article id 151
Article in journal (Refereed) Published
Abstract [en]
Large Language Models (LLMs) have revolutionized natural language processing but present significant technical and legal challenges when confronted with the General Data Protection Regulation (GDPR). This paper examines the complexities involved in reconciling the design and operation of LLMs with GDPR requirements. In particular, we analyze how key GDPR provisions—including the Right to Erasure, Right of Access, Right to Rectification, and restrictions on Automated Decision-Making—are challenged by the opaque and distributed nature of LLMs. We discuss issues such as the transformation of personal data into non-interpretable model parameters, difficulties in ensuring transparency and accountability, and the risks of bias and data over-collection. Moreover, the paper explores potential technical solutions such as machine unlearning, explainable AI (XAI), differential privacy, and federated learning, alongside strategies for embedding privacy-by-design principles and automated compliance tools into LLM development. The analysis is further enriched by considering the implications of emerging regulations like the EU’s Artificial Intelligence Act. In addition, we propose a four-layer governance framework that addresses data governance, technical privacy enhancements, continuous compliance monitoring, and explainability and oversight, thereby offering a practical roadmap for GDPR alignment in LLM systems. Through this comprehensive examination, we aim to bridge the gap between the technical capabilities of LLMs and the stringent data protection standards mandated by GDPR, ultimately contributing to more responsible and ethical AI practices.
Place, publisher, year, edition, pages
2025. Vol. 17, no 4, article id 151
Keywords [en]
AI, AI Act, artificial intelligence, data privacy, GDPR, large language models, Legal Obstacles, LLM, LLMs
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:su:diva-242982DOI: 10.3390/fi17040151ISI: 001474998600001Scopus ID: 2-s2.0-105003460016OAI: oai:DiVA.org:su-242982DiVA, id: diva2:1956871
2025-05-072025-05-072025-05-07Bibliographically approved