Hamburg data protection authority, discussion paper on large language models and personal data (July 2024) (Der Hamburgische Beauftragte fur Datenschutz und Informationsfreiheit, Discussion Paper: Large Language Models and Personal Data, 15 July 2024, thesis 3)
One German regulator holds that training must comply with the GDPR but that a defect in training does not make later use of the model unlawful. The EDPB takes a more cautious view (Opinion 28/2024, paras 126 to 129), so the holder should not count on this softer reading.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The training of LLMs using personal data must comply with data protection regulations. Throughout this process, data subject rights must also be upheld. However, potential violations during the LLMs training phase do not affect the lawfulness of using such a model within an AI system.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide