“DSGVO by design” means data-protection principles are built into how a system processes personal data from the start — not bolted on afterwards — as Article 25 requires. For retrieval-augmented generation, which concentrates documents and personal data into one searchable system, designing for the DSGVO from the outset is the difference between a platform you can defend and one you have to apologise for.
The three articles that matter most
Self-hosting turns these principles into concrete properties: minimised, per-project processing (Art. 5, 25); no new sub-processor, so data stays in your controllership (Art. 5, 28); confidentiality and integrity in your own stack, with audit logs (Art. 32); citation-backed answers for accuracy and accountability (Art. 5); and backup, restore and air-gap options for availability and resilience (Art. 32).
Where the work still sits with you
A practical checklist
When evaluating any RAG platform against the DSGVO, look for:
- Per-project scoping and isolation (purpose limitation, minimisation).
- Self-hosting with no mandatory sub-processor (controllership, transfers).
- Access controls and complete audit logs (Art. 32, accountability).
- Citations on answers (accuracy, demonstrability).
- Export and deletion you control (storage limitation, data-subject rights).
This is general information, not legal advice; confirm your obligations with qualified counsel. See the compliance page for how this maps across the platform.
Frequently asked questions
Does self-hosting make us DSGVO compliant by itself?
No. It removes transfer and sub-processor exposure and provides the technical measures Articles 25 and 32 expect, but you still need lawful basis, retention rules, a DPIA where required, and a process for data-subject requests. Compliance is the combination of the technology and your organisational measures.
Do we still need a DPIA?
Often, yes — particularly where processing is likely to result in a high risk to individuals. Self-hosting can reduce some risks (transfers, third-party access), which may simplify the assessment, but it does not remove the obligation to assess.
Where do citations fit into data protection?
They support accuracy and accountability: an answer you can trace to a source is one you can verify and stand behind. Combined with audit logs, citations help you demonstrate how a result was produced — useful for both the DSGVO and the EU AI Act.
Sources & further reading
- GDPR / DSGVO — Regulation (EU) 2016/679 (full text) — Articles 5, 25, 32 and 83 (fines)
- EDPB — Guidelines on Data Protection by Design and by Default — Article 25 in practice
- Do you need a DPIA for your RAG deployment? — the decision guide