Blog ·

Client data in fine-tuning: what to tell your client (GDPR)

An EU client usually asks one question about a fine-tuned model before accuracy: "where does our data go?" Below is the answer in a form you can put in a proposal. It is a summary of the rules as of October 2026, not legal advice. Check your own contracts with your lawyer.

Who is who

Under GDPR, the client that decides why and how its customers' data is processed is the controller. Your agency, processing that data on the client's instructions, is a processor. Every vendor you use for that work, such as an LLM API or a fine-tuning platform, is a sub-processor (GDPR Art. 4 and 28; EDPB Guidelines 07/2020).

There is one exception. If you reuse a client's data for your own purpose, such as training a model you sell to other clients, you become a controller for that purpose. Keep each client's model trained on that client's data.

What the DPA has to say

Article 28(3) lists what the contract between your client and you must contain. In short, you process only on documented instructions, keep staff bound to confidentiality, secure the data, help with data-subject requests and breaches, delete or return the data at the end, and allow audits.

Article 28(2) and (4) cover sub-processors. You need the client's written authorisation before you add one. Under a general authorisation, you must tell the client about changes and give them time to object. The same obligations must pass down to each sub-processor by contract, and you stay liable for them.

In practice that means a sub-processor annex: each vendor, what it does, and where.

Where the data goes during a fine-tune

Be exact in this part. Clients check, and "your data never leaves the EU" is rarely true for an LLM project. For a run on Honed, the path looks like this:

Step What happens Where
Upload The file is stored and masked: emails, URLs, IBANs, card numbers, tax IDs and phone numbers become tags like <EMAIL_1> Cloudflare R2, EU jurisdiction
Data writing and labelling Model providers write and label extra training examples Through Vercel AI Gateway to model providers, mostly US
Training LoRA training on an open base model Tinker (Thinking Machines), US
Evaluation Your model and the models you compare against answer the test set Tinker and model providers via AI Gateway, mostly US
Deletion The uploaded file is deleted right after the eval, and at the latest after 7 days. The masked training examples and the model stay in your account until you delete them. –

The full list of sub-processors is in our privacy policy and DPA.

The major API providers do not train on API data by default. OpenAI and Anthropic keep API data for up to 30 days for abuse monitoring (OpenAI, Anthropic). Google's paid Gemini API keeps prompts for 55 days and does not train on them. In the EEA, Switzerland and the UK, the paid-tier terms apply to all Gemini API use (Gemini API terms).

Transfers to the US

Transfers to US vendors rest on one of two tools:

  • The EU-US Data Privacy Framework, if the vendor is certified. The EU General Court upheld it on 3 September 2025 (case T-553/23). An appeal, C-703/25 P, is pending at the Court of Justice (CURIA press release).
  • Standard Contractual Clauses under Decision 2021/914, with a transfer impact assessment (EUR-Lex). These remain the fallback if the Framework falls.

For UK clients, use the UK IDTA or the UK Addendum to the EU clauses (ICO). Data can flow from the EU to the UK freely. The EU renewed the UK's adequacy decision on 19 December 2025, until 27 December 2031 (Decision 2025/2574).

Send less data

Start with data minimisation (Art. 5(1)(c)). A ticket router needs the ticket text, not the customer's name, account number or order history. Strip those before export, then let the platform's masking catch what is left. Masking is pseudonymisation, so the data stays personal data under GDPR, but the risk is lower and the DPA discussion is easier.

The AI Act

A narrow fine-tune almost never makes your agency a "provider of a general-purpose AI model". The Commission's July 2025 guidelines set the line at a modification using more than one third of the original model's training compute (AI Act Service Desk). A LoRA run on a few thousand examples uses a tiny fraction of that.

The system rules still apply to what you build. They include AI literacy for staff (Article 4, since February 2025), transparency when people talk to an AI (Article 50), and the high-risk rules for uses such as hiring or credit. Under the Digital Omnibus, Regulation (EU) 2026/1744, the high-risk rules for stand-alone systems apply from 2 December 2027.

A paragraph for your proposal

We train a dedicated model for you on your data only. Uploaded files are stored in the EU, personal identifiers are masked on upload, and the files are deleted within 7 days. The masked training examples and the model stay in the account until we delete them for you. Training and evaluation run through the sub-processors listed in the annex, under the EU-US Data Privacy Framework or Standard Contractual Clauses. The model is used only for your project.

Sources