In-house or EU-hosted AI vs external generative AI: what changes when documents contain personal data

What exactly are we comparing?

Option A, in-house or EU-hosted AI: the model that reads the document (for example, to detect personal data) runs on your own servers or on a provider's servers in the EU, and the content is not forwarded to anyone else. The provider acts as a processor under a contract, with a known list of sub-processors.

Option B, external generative AI: the full text goes to a third-party service, whether a consumer chatbot, an enterprise plan or an API. What happens next depends on the provider's terms: where the data is processed, how long it is kept, who can review it and whether it is used to improve models.

A word of caution: cloud does not mean risky. A European SaaS tool is also cloud. What matters is who processes the data, where, under which contract and for what purposes.

International transfers under UK GDPR and EU GDPR

Chapter V of the GDPR (and its UK counterpart) only allows personal data to leave the EEA or the UK on the basis of an adequacy decision or adequacy regulations, appropriate safeguards such as standard contractual clauses or the UK International Data Transfer Agreement, or narrow exceptions. Sending a document to a service whose processing or support sits in another country can be a restricted transfer even if it does not feel like one.

For the United States, the European Commission adopted Implementing Decision (EU) 2023/1795 on 10 July 2023, finding the EU-US Data Privacy Framework adequate. It covers transfers to US organisations that have self-certified and appear on the Department of Commerce's official list. The UK followed with the UK Extension to the framework, the so-called UK-US data bridge, in force since 12 October 2023. If the specific US entity receiving the data is not certified, you need another mechanism, usually standard clauses plus a transfer risk assessment. The framework has been challenged before the EU courts, so keep an eye on it.

In the US itself, sector rules can apply: under HIPAA, a covered entity that lets a vendor handle protected health information generally needs a business associate agreement with that vendor first.

Processor contracts, retention and use of your data

If your organisation uses an external service to process personal data on its behalf, that provider is your processor and Article 28 requires a contract covering documented instructions, staff confidentiality, Article 32 security, sub-processors and deletion or return of data at the end.

Consumer versions of many chatbots run on terms written for individuals, and the provider may reserve its own uses of what you type. Enterprise plans and APIs usually offer a data processing agreement, but do not assume it: check the provider's terms before you send anything.

• Are prompts and files used to train or improve models? Can that be switched off, and at user or organisation level?
• How long are conversations, files and logs kept, including for abuse monitoring?
• In which countries is data processed, and from where is support access possible?
• Is there a signed data processing agreement and an up-to-date list of sub-processors?
• Who in your organisation has an account, with which settings, and who controls them?

Confidentiality and professional secrecy

Lawyers, clinicians and public servants carry duties of confidentiality on top of data protection law, and legal professional privilege can be put at risk by careless disclosure. Pasting a client letter into a consumer chatbot means handing that information to a third party, even if it never leaks. And not everything sensitive is personal data: litigation strategy, bids and trade secrets deserve protection too.

The ICO's position, set out in its response to its generative AI consultation series, is that there is no AI exemption from data protection law: the same principles of lawfulness, purpose limitation, accuracy and accountability apply to organisations that deploy these tools.

The EU AI Act, briefly

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages: prohibited practices and the AI literacy duty in Article 4 from 2 February 2025, general-purpose model obligations from 2 August 2025, and the rest later. It does not replace the GDPR. It applies to UK organisations mainly when they place AI systems on the EU market or their outputs are used in the EU. Using a chatbot to summarise documents does not make you the provider of a high-risk system, but you should train users and decide what the tool may be used for.

Side-by-side comparison

When each option makes sense

• In-house or EU-hosted AI: documents with client, patient, employee or citizen data; files covered by professional secrecy; large repetitive volumes; teams that need traceability and audit logs.
• External generative AI: text with no personal data or confidential content, generic drafts, templates, translations of public material, or documents that have already been anonymised.
• Both together: anonymise or pseudonymise first with a tool that keeps data in the EU, then use the chatbot only on the clean version.

The third route is the most practical for many teams; we explain it in anonymising documents before using ChatGPT or other chatbots. Bear in mind that pseudonymised data is still personal data for whoever holds the key (recital 26 GDPR), so decide whether pseudonymisation is enough or you need irreversible anonymisation.

Anonimatum follows option A: it detects personal data with its own AI running on servers in the European Union, without sending the text to external language model APIs, combines AI with pattern rules and lets you review every suggestion before applying it. See where documents are processed and what is retained on our security and data protection page, and compare approaches in manual vs automatic anonymisation.