RAG and EU data protection

GDPR-compliant RAG, and the three places most builds break it

A retrieval system does not become compliant because the model is hosted in Frankfurt. What fails an audit is erasure that never reaches the embeddings, a memory store nobody documented, and answers that cite a document rather than the passage they came from.

The question a buyer asks is usually "is your RAG GDPR compliant". The question underneath it is narrower and more answerable: if a person exercises their rights next month, can this system actually do what the law requires, and can somebody prove it did. Most builds fail that second question in one of three specific places.

Break one: erasure stops at the source document

A retrieval pipeline is a copying machine. One uploaded PDF becomes a stored file, a set of text chunks, a set of vector embeddings, possibly a keyword index, sometimes a cached answer that quoted it, and, if the assistant has memory, a conversation record that repeated its contents back to a user. Delete the PDF and six copies of the personal data inside it remain.

Article 17 does not care which store the data sits in. Designing for it means one thing at build time: every derived artefact carries the identifier of the record it came from, so deletion is a traversal rather than an investigation. Retrofitting that after launch is expensive, which is the honest reason so many systems quietly cannot do it.

The list to write down before you index anything: source store, chunk store, vector store, keyword index, answer cache, conversation memory, application logs, and any observability tool capturing prompt contents. That last one catches teams out more than the rest combined.

Break two: the transfer nobody mapped

Chapter V governs personal data leaving the EEA, and the mapping exercise usually stops at the chat model. It should not. An embedding call sends the text of your chunks to whoever runs the embedding model. A reranker sees the retrieved passages. An evaluation suite may be replaying real user queries against a third party. A logging or tracing service may be storing prompts and completions in a different jurisdiction entirely.

You have three workable positions, and picking one early saves a procurement cycle later. Run the whole pipeline on infrastructure you control, which is the strongest position and the most work. Use EU-region endpoints from providers offering them, with transfer safeguards documented and a real answer to onward transfer. Or keep personal data out of the retrieval corpus altogether by redacting at ingestion, which is viable more often than people expect when the useful content is procedural rather than personal.

Break three: a citation you cannot follow

This is the one that separates engineering from marketing. Naming a source document is not traceability. If the document is 180 pages and has been revised four times, a citation to the document tells an auditor nothing about whether the answer is supported. Adequate citation resolves to a version and a passage, and it survives the document being updated afterwards.

We learned the discipline for this on work that had no tolerance for anything less. Digiton built an AI oral-history platform for an African cultural-heritage institution, processing more than 60 hours of recorded testimony and over 1,000 pages of transcripts through retrieval pipelines. Every retrieved passage carries which recording it came from, which section, and which speaker, so a researcher can go from an answer back to the original audio and verify it themselves. That work was presented publicly at Universidade Aberta in Lisbon in April 2026.

Heritage material forced a second property that regulated corporate estates also need. Oral testimony contains accounts that contradict each other, and the disagreement is often the historically important part. A naive system synthesises one confident answer and discards the tension. Ours surfaces the divergent passages instead. The same architecture is what stops a corporate assistant from confidently merging a superseded policy with its replacement.

Refusal is a compliance feature

Digiton also deployed a closed-RAG academic assistant inside Moodle for a Central American university, delivered through a partner. Closed RAG means the assistant answers only from a defined, approved corpus, and says plainly when a question falls outside it rather than reaching into the model's training data.

Universities want that for academic integrity. Regulated buyers want it for a different reason: a system that answers from an approved corpus has a defensible processing scope, and one that will improvise does not. Write the refusal behaviour into acceptance criteria, because it is the property most likely to be tuned away when someone complains the assistant is unhelpful.

The self-hosted stack, without the sales pitch

For teams keeping everything in-house, pgvector is the pragmatic default when you already run Postgres and your corpus is measured in the low millions of chunks, because it removes a system rather than adding one. Qdrant and Milvus earn their operational cost at larger scale or where filtered search performance matters. The choice of vector store is rarely what decides whether a project succeeds.

The honest trade sits above that layer. Open-weight models you can host yourself still sit behind frontier models on reasoning quality. For grounded question answering over a corpus you supply, the gap is usually narrow enough not to matter. For open-ended analysis it is not. Test on your own material before committing to a sovereign stack on principle.

What belongs in the DPIA

• Every store holding a derived copy, with the retention period for each.
• The lawful basis for the processing, and whether the corpus contains special category data.
• Every processor in the chain with its region. Embedding and reranking count. So does anything that logs prompt contents or replays real queries.
• The erasure procedure, tested end to end, with evidence that it reached the vector store.
• The human oversight path when an answer is contested, and how a contested answer is traced.

This is engineering guidance from deployed systems, not legal advice. Take the finished design to your data protection officer or counsel. Related reading: enterprise RAG for legal teams and RAG systems for business.

Frequently asked questions

Related