GDPR compliance for AI agents —
enforced on every LLM call.
EU AI has a transparency problem. LLMs echo personal data without disclosure, make automated decisions without informing users of their Art. 22 rights, and invent false claims about data retention. Peekr enforces GDPR rules in-process before responses reach EU data subjects — no proxy, no architecture change.
Why GDPR on LLM outputs is hard
Personal data leaks through context
You pass a user record as context. The LLM repeats their full name, email, and address in its reply. Under GDPR Art. 5, personal data processing must be lawful, fair, and transparent — the user never consented to their data being echoed.
Automated decisions without disclosure
"Based on your profile, you do not qualify." That's an automated decision with a significant effect under Art. 22. GDPR requires disclosure of the logic, the significance, and the right to request human review — LLMs skip all three.
False transparency statements
"This conversation is completely private and not stored anywhere." If you're logging traces (you should be), that's a false statement under Art. 13/14 transparency obligations. LLMs confidently invent privacy assurances.
What Peekr enforces
The GDPR pack runs as a guardrail inside your agent process. Every LLM response is checked before it reaches the data subject. Violations are blocked (or warned) and stored in an immutable audit log your DPO can access.
| Category | What it catches | Action |
|---|---|---|
| Personal data in output | Name + email/phone/address combination echoed in LLM response | Block + redact before storage |
| False retention claim | "We store your data forever", "this is permanently recorded" | Block — must reflect actual retention policy |
| Undisclosed data logging | "This conversation won't be logged", "nothing is stored" when it is | Block — Art. 13/14 transparency obligation |
| Automated decision (Art. 22) | Decision with legal/significant effect without human review disclosure | Warn — add Art. 22 disclosure + right to object |
2 lines to enforce GDPR
Add compliance=["GDPR"] to your existing peekr.instrument() call. Rules are fetched from Peekr Cloud and enforced locally — no data leaves your process.
import peekr
peekr.instrument(
exporter=peekr.HTTPExporter(
endpoint="https://peekr.starkspherelabs.com",
api_key="pk_live_...",
),
compliance=["GDPR"], # ← add this line
)
# Every LLM call is now GDPR-checked.
# Personal data is redacted from traces. Art. 22 decisions are flagged.
# Violations go into an audit log your DPO can read.Works with OpenAI, Anthropic, Google Gemini, Amazon Bedrock, LangChain, and CrewAI — auto-instrumented, no code changes per call.
DPO-ready audit logs
Every violation is stored as a tamper-evident record: which rule fired, which text triggered it, which model produced it, and when. Your Data Protection Officer can filter by regulation, export records for DSAR responses, and present logs directly to a supervisory authority.
Per-violation detail
Pack, rule name, matched text, span ID, timestamp, tenant.
DPO access
Data Protection Officer gets read-only dashboard access, no code required.
7-day rolling window
Default retention. Enterprise gets configurable retention + DSAR export.
Immutable records
Violations can't be deleted by the app — only by explicit data retention policy.
Common questions
Does GDPR apply to AI systems?
Yes. GDPR applies wherever an AI system processes personal data of EU data subjects, regardless of where the data controller is located. This includes AI chatbots, automated decision systems, and LLM-based agents that handle names, emails, IDs, or any information relating to an identified or identifiable natural person.
What is Article 22 and why does it matter for AI?
Art. 22 gives data subjects the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. If your AI makes eligibility, credit, hiring, or access decisions without a human in the loop, you must (a) inform the data subject, (b) explain the logic, and (c) provide a way to request human review. Peekr flags automated decision outputs that lack these disclosures.
What is the difference between GDPR and the EU AI Act?
GDPR governs personal data processing — transparency, lawful basis, data subject rights, and security. The EU AI Act governs AI system risk classification, conformity assessments, and prohibited practices. They overlap: an AI system processing personal data must comply with both. Peekr's GDPR pack covers data-in-output controls; an EU AI Act pack addresses risk classification and transparency disclosures.
Does Peekr store personal data?
When a violation is detected, Peekr stores a truncated match (not the full personal data), the rule name, span ID, and timestamp. Full personal data is redacted before being written to the audit log. For Enterprise customers, we sign a Data Processing Agreement (DPA) covering our role as a data processor under GDPR Art. 28.
How does this help Data Protection Officers?
DPOs use Peekr to (1) demonstrate technical controls to supervisory authorities during audits, (2) identify AI outputs that may constitute Art. 22 automated decisions before they reach data subjects, (3) generate audit trails for DSAR responses, and (4) monitor for personal data leakage across LLM-powered features without reading every conversation.
Start enforcing GDPR on your AI today
Free tier includes the GDPR pack — 10,000 spans/month, no credit card.
Need HIPAA, FDCPA, FINRA, or UAE compliance? See all 10+ compliance packs →