DeepSeek and GDPR / AI Act: a major risk for your data

Overview and data processed

DeepSeek is a generative AI developed by a Chinese start-up, whose models (V3, R1) achieved meteoric success in early 2025 thanks to very low cost and an open model. This success immediately ran into strong data protection concerns in Europe.

DeepSeek collects account data (email address, etc.), prompts and conversation history, and technical data. Its privacy policy indicates storage on servers located in the People's Republic of China. Researchers have also reported security flaws (data transmitted without encryption, exposure of an internal database in early 2025).

The risks for your business

The risk is direct and severe: transfer of personal data to China without safeguards, no DPA, inadequate legal basis and transparency, documented security flaws. Using DeepSeek with customer or employee data exposes the business to head-on non-compliance.

Main GDPR risks:

• Transfer to China: no adequacy decision; safeguards (SCCs) not established.
• Absence of known data processing agreement (Article 28).
• Transparency and legal basis insufficient (grievances from authorities).
• Security: documented flaws and leaks; exercise of rights highly uncertain.

GDPR obligations

1. As a matter of principle: do not transmit personal data to DeepSeek in its current state.
2. If assessment ongoing: block the tool on the IS and via the AI charter.
3. Document the decision to prohibit/control in the record of processing activities.
4. Inform and raise awareness among teams about the 'servers in China' risk.
5. Involve the DPO; monitor the outcome of proceedings (Italy, CNIL, DPC, Belgium).

AI Act obligations

As a GPAI model provider, DeepSeek is covered by the AI Act (obligations applicable since 2 August 2025), which applies as soon as the system is used in the EU. The deployer remains subject to transparency (Article 50), human oversight and AI literacy—but the primary issue here is the very lawfulness of the processing under the GDPR. See the AI Act guide.

Cybersecurity and best practices

Cyber risks: documented technical flaws (encryption, database exposure), uncontrolled transfer and storage outside the EU, shadow AI via the free app. Major risk for NIS 2 entities.

Best practices: prohibit DeepSeek for any processing of personal data in the business; block the application on business devices; favour compliant/sovereign alternatives (e.g. Mistral, Azure OpenAI, on-premise); explicit AI charter, awareness-raising, record.

Compliance checklist:

• Use of DeepSeek prohibited for personal data
• Application blocked on business devices, decision documented in the record
• Compliant alternative identified, teams made aware of 'China' risk
• Position set out in AI charter, monitoring of ongoing proceedings, DPO involved

Sanctions, conclusion and recommendations

Sanctions (two cumulative regimes): GDPR up to €20m or 4% of total worldwide annual turnover; AI Act up to €35m or 7% for prohibited practices, and €15m or 3% for most other infringements. Context: the Italian Garante blocked DeepSeek as early as January 2025; several European authorities (CNIL, Irish DPC, Belgium) have initiated analyses and investigations. The user business that exposes personal data via DeepSeek would face characterised GDPR non-compliance.

Recommendation: DeepSeek illustrates the 'low-cost AI, non-existent compliance' risk. As long as the absence of safeguards on transfers to China and the lack of a DPA persist, our recommendation is unambiguous: do not use it for personal data in the business, block it on the IS, and steer teams towards compliant alternatives—ideally sovereign ones like Mistral Le Chat. Compare with other assistants: ChatGPT, Claude.