DSK AI guidance: what the German DPAs expect from AI assistants and RAG
The German data protection authorities’ guidance on AI, known as the
As of 4 November 2026 · not legal advice
Key points
- The DSK has published
three guidance papers on AI: May 2024 for users, June 2025 on technical and organisational measures, and October 2025 on RAG specifically. - The papers are
not law , but they show how the supervisory authorities read the GDPR for AI. - On RAG, the DSK says data in the index can be
corrected and deleted one by one and access can be controlled. Inside the language model itself, deletion and correction remain largely unsolved. - In the DSK’s view, a
data protection impact assessment will often be needed when AI is used, for example for customer advice chatbots.
What is the DSK, and how binding are its papers?
The
A guidance paper is
Three guidance papers on AI and one DPIA list.
The three papers complement each other. For a company introducing an AI assistant, the May 2024 paper is the starting point. The October 2025 RAG paper is the only one that deals directly with the “AI on your own documents” architecture.
| Paper | Aimed at | What matters for your AI assistant |
|---|---|---|
| AI and data protection, 6 May 2024 | Controllers that use AI applications | Checkpoints in three phases: design and selection, implementation, use. Margin numbers 1 to 69. |
| Technical and organisational measures, June 2025 | Mainly makers and developers; users for procurement | Measures per life-cycle phase, sorted by the seven protection goals of the German Standard Data Protection Model (SDM). |
| Generative AI systems using RAG, October 2025 | Controllers that run RAG systems (our reading; the paper names no audience) | How RAG changes accuracy, transparency, confidentiality, purpose limitation, deletion and data subject rights. Scenario: everything run by the controller. |
| DPIA list, version 1.1, 17 Oct 2018 | Private-sector bodies | Item 11: AI that processes personal data to steer interaction with data subjects or evaluate personal aspects. |
OH = Orientierungshilfe (guidance). For the public sector, the supervisory authorities have published their own DPIA lists. On 12 December 2025 the DSK also issued a resolution on GDPR reform calling for new legal bases for AI models and substitute safeguards for data subject rights that are hard to implement.
The core requirements in eight groups.
Summarised from the three guidance papers. References are given so your data protection officer can check them.
Purpose and legal basis
Define fields of use and purposes up front. Every processing step with personal data needs a legal basis, including embedding and the vector database. (2024 guidance margin no. 1, 9; RAG guidance sec. 3.6)
Choosing the AI system
According to the DSK, technically closed systems are preferable. Prefer applications that do not use inputs and outputs for training. The provider must supply enough information for transparency and the DPIA. (2024 guidance margin no. 20, 24, 40)
Transparency
Inform data subjects about the processing. In RAG, showing the sources used makes it traceable what an answer relies on. It does not make the inner workings of the language model more transparent. (2024 guidance margin no. 21 ff.; RAG guidance sec. 3.2)
Data subject rights
Correction and deletion must be workable technically and organisationally. Filters are not generally a deletion. In the RAG index, entries can be deleted one by one; inside the language model this remains largely unsolved. (2024 guidance margin no. 26 to 30; RAG guidance sec. 3.5, 3.7)
Accuracy and hallucinations
Check results that relate to people before using them further. RAG can reduce hallucinations but not rule them out. Quality depends on current, complete reference documents. (2024 guidance margin no. 64 f.; RAG guidance sec. 3.1)
Technical and organisational measures
Privacy by design and by default, IT security, a roles and permissions concept, logging, a deletion concept. For RAG: tenant separation and rights per area of the vector database. (2024 guidance margin no. 43 f.; TOM guidance sec. 1.4; RAG guidance sec. 3.3)
Staff and works council
Clear internal rules, company accounts instead of private ones, training. Involve the data protection officer, consider the works or staff council, consider a works agreement. (2024 guidance margin no. 31, 36 f., 41, 46)
Data protection impact assessment
Assess the risk up front. Where the processing is likely to result in a high risk, a DPIA under Art. 35 GDPR is mandatory, which for AI the DSK expects in many cases. The DPIA list names AI expressly in item 11. (2024 guidance margin no. 38 to 40; DPIA list item 11)
What the requirements mean in practice for an AI assistant with RAG.
The left column names the requirement and where to find it. The other columns are our translation into the day-to-day of a company running an AI assistant on its own documents. Owners and evidence are suggestions; adapt them to your organisation.
| Requirement | What it means for an AI assistant with RAG | Who | Evidence |
|---|---|---|---|
| Define the purpose 2024 guidance no. 1 | Record for each assistant which document collections it uses and which questions it should answer. An HR assistant and a sales assistant are separate purposes. | Business owner with DPO | Purpose entry in the record of processing activities |
| Legal basis, including the index 2024 guidance no. 9; RAG guidance 3.6 | Splitting documents with personal data into chunks, embedding them and storing them in the vector database are processing steps in their own right. Each needs a legal basis. | DPO, legal | Legal basis per step in the record, where relevant a documented balancing test |
| Closed system, no training 2024 guidance no. 20, 24 f., 43 | Do not use inputs and outputs for training. By default, do not keep chat history beyond the session; users decide whether their own history is stored (no. 25, 43). Run it in a contained environment where possible. | IT operations | Configuration record; data processing agreement if run externally |
| Only necessary data in the index RAG guidance 3.1, 3.5 | Decide deliberately which sources are indexed. Remove or anonymise personal data the purpose does not need before indexing. | Business data owner | Approved source list per index |
| Access rights per document RAG guidance 3.3, 3.4; TOM guidance 2.4.7 | The assistant may only use chunks from documents the person asking is allowed to see. Separate areas, assign roles per purpose. With every new data source, check whether all users may access it. | IT admin, business owner | Roles and permissions concept, review note per new source |
| Sources with every answer RAG guidance 3.2 | Answers show which document and passage they come from. That makes it traceable what the answer relies on and makes checking easier. | Product owner | Screenshot or test record showing citations |
| Ensure accuracy RAG guidance 3.1; 2024 guidance no. 64 f. | System instruction: answer only from the sources. Review reference documents for currency regularly. Add external sources only once lawfulness, suitability and accuracy have been checked; according to the DSK, web search regularly does not meet these requirements. Have results about people checked before they are used further. | Business owner, product owner | Review cycle for documents, test questions with results |
| Correction 2024 guidance no. 27; RAG guidance 3.1 | Correct wrong information in the source document and have the index rebuilt. Then check that the old version no longer shows up in answers. | Data owner, IT | Ticket with time of re-indexing |
| Deletion down to the index RAG guidance 3.5; 2024 guidance no. 28 f. | A deletion in the source system must also remove the chunks, their embeddings, caches and stored chat histories. Retention periods apply to documents and the vector database alike. An output filter alone is not a deletion. | IT operations, DPO | Deletion concept, dated deletion log |
| Access requests RAG guidance 3.7 | Be able to find and report personal data in prompts, answers, reference documents and the vector database. | DPO, IT | Documented access process, dry run |
| Logging TOM guidance 1.4, 2.4.1 | Record which data was processed by which AI system and who changed sources, models and rights. Logs themselves need a retention period. | IT security | Logging concept, extract from the change log |
| A human decides 2024 guidance no. 12 f.; TOM guidance 2.4.4 | The assistant supplies drafts and references. Decisions with legal effect, for example on job applications, are made by a person with real discretion. | Business owner | Process description with an approval step |
| Staff and works council 2024 guidance no. 31, 36 f., 41, 46 | Usage policy with allowed and forbidden examples, company accounts, training. Check works council involvement, consider a works agreement. | HR, works council, DPO | Approved policy, works agreement, training records |
| DPIA 2024 guidance no. 38 to 40; DPIA list item 11 | Preliminary assessment for every assistant. If it steers interaction with customers or evaluates people, the DPIA list requires a DPIA. Request information on how the system works from the provider. | DPO | Preliminary assessment or DPIA report |
| Track changes 2024 guidance no. 47; TOM guidance 2.4.1 | Repeat tests after model changes, updates and new sources and document the results. Check which duties under the EU AI Act also apply. | IT, DPO | Change and test log |
Own synthesis based on: DSK, guidance “Künstliche Intelligenz und Datenschutz” (AI and data protection), version 1.0, 6 May 2024; DSK, guidance on recommended technical and organisational measures for developing and operating AI systems, version 1.0, June 2025; DSK, guidance on data protection aspects of generative AI systems using the RAG method, version 1.0, October 2025; DSK, list of processing operations requiring a DPIA (private sector), version 1.1 of 17 Oct 2018. “No.” = margin number, numbers with dots = sections.
Why deletion and correction are easier with RAG than with a fine-tuned model.
If you want a language model to use company knowledge, there are two routes: retrain the model (fine-tuning) or connect it to a document search (RAG). The DSK describes the difference this way: the contents of the vector database are retrieved fresh for every query and do not change the model. Unlike information learned by the model, they can easily be updated, deleted and disclosed on request.
Where a trained model contains the information to be deleted, the guidance on technical measures generally requires a new training run or suitable retraining (machine unlearning), whose success must be demonstrated. Filters count only as an interim measure. That does not mean RAG solves everything: whatever the language model itself contains from its training is not affected.
| Aspect | Knowledge in the index (RAG) | Knowledge in the model (fine-tuning) |
|---|---|---|
| Deletion | Entries in the vector database and documents deletable one by one, also by retention rule (RAG guidance 3.5) | Usually a new training run or machine unlearning with proof of success; filters only as interim (TOM guidance 2.4.4) |
| Correction | Correct or delete the source document (RAG guidance 3.1) | For example by correcting data or retraining (2024 guidance no. 27) |
| Access rights | Controllable via roles and separate areas of the vector database (RAG guidance 3.3) | Not controllable inside the language model (RAG guidance 3.3) |
| Traceability | Sources used can be documented; the model stays opaque (RAG guidance 3.2) | Origin of a statement hard to trace |
The last cell is our own assessment; the others reflect the references given.
How a self-hosted RAG platform helps with the evidence.
Much of the evidence in the table comes from where the assistant runs. A self-hosted RAG platform such as RAGSuite cites the source for every answer, separates content into projects with their own sources, deletes automatically with deletion receipts and records changes in an audit log (Community Edition: last 15 days). Roles and project access, retention policies with legal hold, and the full audit history with export come with the Enterprise Edition. RAGSuite does not automatically take over per-document permissions from source systems; you control access through projects. Whether your use meets the requirements still depends on purpose, legal basis and configuration; that remains the job of your organisation and your data protection officer.
Is your AI assistant ready for a review against the DSK papers?
Tick what is done. Nothing is stored.
Questions about the DSK AI guidance.
What is the DSK AI guidance?
It usually means the guidance “Künstliche Intelligenz und Datenschutz” (AI and data protection) published by the Datenschutzkonferenz (DSK) on 6 May 2024. It is aimed mainly at companies and public bodies that use AI applications and walks through selection, implementation and use. It is complemented by guidance on technical and organisational measures (June 2025) and guidance on RAG systems (October 2025).
Is the DSK guidance legally binding?
No, it is not law. The GDPR and the German Federal Data Protection Act (BDSG) are binding, and the courts have the final say on how they are read. The guidance does show how the German supervisory authorities read the GDPR for AI. It describes itself as a guide and expressly not as an exhaustive list of requirements. If you deviate from it, you should be able to explain why.
Is there DSK guidance specifically on RAG?
Yes. In October 2025 the DSK published guidance on the data protection aspects of generative AI systems using the RAG method. It looks at RAG systems with embeddings and a vector database that are run entirely by the controller. Its finding: RAG can make accuracy, confidentiality and data subject rights easier to handle, but it does not solve the problems of the language model itself.
Do I need a DPIA for an AI assistant?
Often, yes. According to the May 2024 guidance, a DPIA will in many cases be required when AI is used. Item 11 of the DSK list of processing that requires a DPIA covers AI that processes personal data to steer interaction with data subjects or to evaluate personal aspects, for example a customer advice chatbot. An internal assistant working on manuals without personal data may be assessed differently. You need a documented preliminary assessment either way.
How do I delete personal data in a RAG system?
In the source document and in the index: according to the RAG guidance, entries in the vector database are directly addressable and can therefore be deleted one by one, including through normal retention rules. Make sure a deletion in the source system also removes the text chunks, their embeddings and stored chat histories. What a language model contains from its training cannot be deleted this way. According to the DSK, that problem remains.
Does the works council have to be involved?
It depends on the use. The DSK recommends always involving the data protection officer and considering whether the works or staff council must take part. It sees a works agreement as useful and notes that introducing an AI application will in some cases trigger co-determination rights. Separately from the DSK papers, section 87(1) no. 6 of the Works Constitution Act (BetrVG) is usually examined: co-determination applies to technical systems that are objectively capable of monitoring behaviour or performance, for example through logs. Staff councils in the public sector follow their own staff representation law.
Does RAG solve the data protection problems of large language models?
Only in part. The DSK makes clear that an unlawfully trained model remains unlawfully trained inside a RAG system, and that data subject rights inside the model are largely unsolved. RAG can reduce risks, though: answers rely on reviewed documents, access can be controlled, and data in the index can be corrected and deleted. Depending on the design, the DSK sees RAG as one of several risk-reducing measures.
Evidence for the data protection review, straight from the AI assistant.
Stefan walks through the implementation table with you and shows which evidence the platform supplies and where your organisation has to do the work.