GDPR-compliant LLM workflows for law firms combine an EU-hosted or contractually safeguarded language model, a signed data processing agreement (DPA) under Art. 28 GDPR, strict data minimisation, and a retrieval layer that keeps client data inside systems the firm controls. In practice this means never sending identifiable client data to a model that trains on inputs, documenting a lawful basis for processing, and logging every prompt and output for accountability under Art. 5(2). Done correctly, a firm can use LLMs for drafting, research, and review while remaining defensible before a supervisory authority.
Why law firms need a different LLM standard
Law firms process special-category and confidentiality-protected data by default: client identities, litigation strategy, financial records, and in many DACH jurisdictions data covered by professional secrecy (§ 203 StGB in Germany). That raises the bar above ordinary GDPR compliance.
Three obligations stack on top of each other:
- GDPR — lawful basis, DPA, data minimisation, transfer rules.
- Professional secrecy — in Germany, § 203 StGB and § 43e BRAO require that any external service provider with potential access to client secrets is contractually bound to confidentiality.
- Bar association guidance — most DACH and EU bars now expect documented risk assessments before deploying generative AI on client matters.
The consequence: a consumer ChatGPT account used on real case files is almost always non-compliant. A properly contracted, EU-routed enterprise deployment with retention disabled can be compliant.
The core compliance checklist
Before any LLM touches client data, a firm should be able to answer yes to each item below.
- Signed DPA under Art. 28 GDPR with the model provider, naming the firm as controller and the provider as processor.
- Sub-processor transparency — a current list of who else processes the data and where.
- No training on inputs — contractually guaranteed (zero data retention or opt-out from model improvement).
- Data residency or valid transfer mechanism — EU/EEA hosting, or Standard Contractual Clauses plus a transfer impact assessment for US providers.
- Lawful basis documented — usually legitimate interest (Art. 6(1)(f)) for internal drafting, with a balancing test on file.
- § 203 StGB confidentiality clause for German firms, binding the provider and its staff.
- Logging and human review — every output reviewed by a lawyer before client use; prompts and outputs retained for accountability.
- DPIA (Art. 35) where processing is large-scale or high-risk.
EU-hosted vs. US model providers in 2026
The model market splits into three practical options for European firms.
EU-sovereign and EU-hosted models
Providers like Mistral (France), Aleph Alpha (Heidelberg), and IONOS/OVHcloud-hosted open models keep data inside the EU and offer DPAs aligned to German professional-secrecy requirements. For firms that prioritise § 203 StGB defensibility, this is the lowest-friction path.
US providers via EU regions
OpenAI, Anthropic, and Google all offer enterprise tiers with EU data residency, zero data retention options, and DPAs. As of 2026, the EU–US Data Privacy Framework provides an adequacy basis, but a layered approach (DPF + SCCs + transfer impact assessment) is the prudent standard given ongoing legal challenges to adequacy decisions.
Self-hosted open models
Running Llama, Mistral, or Qwen-class models on infrastructure the firm controls (on-premise or a German cloud tenant) removes the third-party processor entirely. This maximises control but shifts the security, patching, and quality burden onto the firm. It suits large firms with IT capacity; most small and mid-size practices are better served by a contracted EU deployment.
A reference architecture: RAG over a firm knowledge base
The safest and most useful pattern for law firms is retrieval-augmented generation (RAG) rather than fine-tuning client data into a model. RAG keeps documents in a database the firm owns and feeds only the relevant snippets to the model at query time.
A typical Mindflows build for a DACH firm looks like this:
- Ingestion — matter documents, precedents, and internal templates are chunked and stored as vector embeddings in an EU-hosted vector database (e.g. Qdrant or pgvector on German infrastructure). Embeddings can be generated by an EU-hosted embedding model so raw text never leaves the region.
- Access control — retrieval respects matter-level permissions, so a query only surfaces documents the requesting lawyer is authorised to see. This prevents cross-mandate leakage, a frequent overlooked risk.
- Pseudonymisation layer — before a prompt is sent to the LLM, an automated step replaces names, account numbers, and identifiers with tokens, which are mapped back in the output. This reduces the personal data exposed to the model.
- Generation — the LLM receives the redacted context plus the question and drafts an answer with citations back to source documents.
- Human-in-the-loop review — output is shown to the lawyer with linked sources for verification before any client-facing use.
- Audit log — prompt, retrieved documents, model version, and output are logged for Art. 5(2) accountability and § 203 traceability.
This architecture means the model never ingests the full case file, the firm controls the data store, and every answer is traceable to a source — which also reduces hallucination risk, the other major liability in legal AI.
High-value, lower-risk use cases to start with
Not every workflow carries the same risk. A staged rollout builds confidence and an evidence trail.
- Internal knowledge search — "Find our last three SPA templates with earn-out clauses." Low risk, high time savings.
- First-draft generation from firm templates, reviewed by a lawyer.
- Document summarisation of long contracts or discovery bundles, with source links.
- Translation and tone adjustment of correspondence (with redaction).
- Intake triage — classifying inbound matters and routing them, using only the data the prospect already volunteered.
Higher-risk activities — automated client advice, decisions affecting individuals, or processing of opposing-party special-category data — should wait until governance, DPIA, and human-review controls are proven.
Implementation steps for a mid-size firm
- Run a data inventory — map which matter data would touch the LLM and classify its sensitivity.
- Choose a deployment model — EU-hosted enterprise tier is the pragmatic default for most firms.
- Sign the DPA and confirm zero retention — get the no-training guarantee in writing.
- Complete a DPIA and § 203 assessment — document the balancing test and confidentiality safeguards.
- Build the RAG layer with access control, pseudonymisation, and logging — this is the engineering core and where automation tools like n8n or Make orchestrate ingestion and review steps.
- Pilot with one practice group on low-risk use cases for 6–8 weeks.
- Train lawyers on prompt hygiene, the duty to verify, and what data must never be entered manually.
- Review and expand based on audit-log evidence.
A realistic timeline is 6–10 weeks from inventory to a governed pilot, depending on how much document ingestion is automated.
Common compliance mistakes
- Using personal/free accounts that train on inputs and lack a DPA.
- Pasting full client documents into prompts instead of using retrieval and redaction.
- No human review — treating model output as final legal work product.
- Ignoring sub-processors — a provider's downstream vendors can break the transfer chain.
- Skipping the DPIA because "it's just a pilot" — supervisory authorities assess intent and scale, not labels.
- No retention policy on logs and embeddings, creating a new storage-limitation problem under Art. 5(1)(e).
FAQ
Is ChatGPT GDPR-compliant for law firms?
The free consumer version generally is not, because inputs may be used to improve models and there is no DPA with the firm. OpenAI's enterprise and API tiers with EU data residency, zero data retention, and a signed DPA can be made compliant, but each firm must still document its own lawful basis, DPIA, and professional-secrecy safeguards.
What lawful basis applies to LLM use on client data?
For internal drafting and research, legitimate interest under Art. 6(1)(f) is the usual basis, supported by a documented balancing test. Where special-category data (Art. 9) is involved, an additional condition — often the establishment, exercise, or defence of legal claims under Art. 9(2)(f) — must apply.
Do we need a DPIA?
Yes, in most cases. Large-scale processing of confidential client data with new technology meets the Art. 35 threshold. The DPIA should cover data flows, the no-training guarantee, transfer mechanisms, and human-review controls.
Can we send German client data to a US-based model?
Only with a valid transfer mechanism. As of 2026 the EU–US Data Privacy Framework provides adequacy for certified providers, but firms should layer Standard Contractual Clauses and a transfer impact assessment, and for § 203 StGB matters prefer EU regions or pseudonymisation before transfer.
How does RAG reduce GDPR risk compared to fine-tuning?
Fine-tuning bakes client data into model weights, making deletion and access control nearly impossible. RAG keeps data in a firm-controlled store with per-matter permissions and a clean deletion path, and feeds the model only the minimum context needed — aligning with data minimisation and the right to erasure.
Mindflows builds GDPR-compliant LLM and RAG workflows for law firms and professional-services firms across the DACH region — from data inventory and DPIA support to EU-hosted retrieval architecture and lawyer review portals. If you want a governed pilot rather than a compliance risk, that is the work we do.