Is DeepSeek GDPR Compliant? Why European Regulators Have Pushed Back

A data analyst in Milan hears that DeepSeek's reasoning model is good at SQL. She opens chat.deepseek.com and pastes a query along with twenty sample rows from the customer table: names, email addresses, a few dates of birth. The query comes back fixed. The rows are now on servers in China, under terms her company never saw.

Of the AI tools in this series, DeepSeek is the one where the answer is clearest, and also the one where staff are most likely to try it anyway, because the models are good and the chat is free.

Is DeepSeek GDPR compliant?

As always, GDPR applies to processing rather than products, and your company is the controller when staff use DeepSeek for work. The problem is what happens next. DeepSeek's privacy policy (last updated 10 February 2026) says it will directly collect, process and store personal data in the People's Republic of China. China has no adequacy decision from the European Commission, the policy doesn't name a specific transfer mechanism such as standard contractual clauses, and the chat service offers your company no data processing agreement.

The policy also says user inputs may be used to train DeepSeek's models, with a right to opt out, and it names Prighter as DeepSeek's representative in the EU and UK. Having a representative is a GDPR requirement; it doesn't solve the transfer question.

What have European regulators done about DeepSeek?

• 28 to 30 January 2025, Italy: the Garante asked DeepSeek how it handles Italian users' data. The app disappeared from Italian app stores, and on 30 January the Garante ordered an urgent limitation of processing of Italian users' data by Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, after the companies replied that they didn't operate in Italy and weren't subject to EU law. It also opened an investigation.
• Late January 2025, other authorities: the Dutch Autoriteit Persoonsgegevens warned users to be very careful with DeepSeek and said it would investigate; it also pointed out that uploading information about other people may itself be unlawful. The Irish and Belgian authorities requested information, and France's CNIL said it would question the company.
• February 2025: the European Data Protection Board extended its ChatGPT taskforce to cover AI enforcement and made it the forum for coordinating on DeepSeek. Several German state authorities also began examining whether DeepSeek had appointed an EU representative.
• 27 June 2025, Germany: after DeepSeek didn't respond to a May request to stop transfers or meet EU transfer rules, Berlin's data protection commissioner reported the DeepSeek app to Apple and Google as unlawful content under the Digital Services Act, asking them to review whether to block it in Germany.

These actions target DeepSeek's consumer service and its transfers to China. They don't make it illegal for your company to use DeepSeek models in every form. They do make clear that regulators see the chat service's handling of EU personal data as a serious problem, and that a company whose staff send customer data there would have a hard time defending it.

DeepSeek chat vs the API vs open weights: what's different?

The last column is the interesting one. DeepSeek publishes open-weight models, and running one yourself, for example with Ollama on your own servers, takes DeepSeek the company out of the data flow entirely. The GDPR questions then become ordinary questions about your own infrastructure.

What does GDPR ask of you here?

1. A lawful basis (Art. 6) and, for health or other special-category data, an Art. 9 condition. Hard to argue for sending either to a service a regulator has restricted.
2. A processor agreement (Art. 28). The chat service doesn't offer your company one.
3. A valid transfer mechanism (Chapter V). This is where DeepSeek fails for most companies: storage in China, no adequacy decision, and no transfer mechanism named in the policy. The Berlin regulator cited exactly this.
4. Data minimization (Art. 5(1)(c)). Sample rows for a SQL question can be invented. Real customers aren't needed.
5. Transparency and records (Art. 13, 14 and 30). If you allow DeepSeek at all, your records should say for what, and with which data.
6. A DPIA (Art. 35) before any approved use that might touch personal data, with the transfer risk front and center.

What should your company do about DeepSeek?

• Write it down. State plainly that personal data, customer data and credentials must not be sent to DeepSeek's chat service or API.
• Assume someone will try anyway. It's free and it's good. A policy without a technical control is a hope.
• Mask on the device and in the browser. Maskflare's browser protection and desktop agent cover chat.deepseek.com: names, emails, IBANs and national IDs are replaced with tokens before the prompt leaves, and credential-shaped values are blocked. The analyst in Milan would still get her SQL fixed, against tokens instead of customers.
• Mask API traffic. If a team uses the DeepSeek API, route it through the Maskflare gateway at /v1/deepseek, so only masked text reaches DeepSeek.
• Consider self-hosting. For teams that want DeepSeek's models specifically, an open-weight model on infrastructure you control removes the transfer to China. Maskflare's gateway also supports self-hosted Ollama if you want the same masking policy in front of it.

What masking can't fix with DeepSeek

• It doesn't make transfers lawful. Masking reduces what reaches DeepSeek. If personal data still slips through, it's still a transfer to China without a mechanism.
• Business secrets aren't personal data. Masking rules catch personal data and credentials; a confidential strategy document typed in plain prose may still go through unless you add your own rules or block the site.
• Blocking is sometimes the right answer. For some companies, especially in the public sector, a block on DeepSeek domains is simpler and easier to defend than any masking setup. Maskflare can block, too.

What about the EU AI Act?

The EU AI Act applies to providers placing AI models on the EU market regardless of where they're based, so DeepSeek is subject to the general-purpose model obligations that have applied since August 2025. For your company, the deployer duties are the usual ones: AI literacy for staff (Article 4, since February 2025) and transparency where AI interacts with people. None of it changes the GDPR transfer problem, which is the main reason to keep personal data away from DeepSeek's servers.

This article is general information, not legal advice. Facts are as of October 2026; check DeepSeek's current policies and your regulator's guidance before relying on them.