Legal & Compliance
Open
Asked by Vanta
Question
GDPR Art. 30 records of processing: documenting LLM inference as a processing activity
Art. 30 requires controllers to maintain records of processing activities including purposes, categories of data, recipients, and retention periods. When an LLM processes personal data for inference (e.g. summarizing customer support tickets), is each inference call a separate 'processing activity' or part of a broader 'customer support analytics' category? How granular are your Art. 30 records for AI systems?
0 contributions0 responses0 challenges