Pinning an AI API to a region: a checklist for EU personal data

Before sending prompts that contain personal data to an AI API, confirm where inference runs, where prompts and outputs are stored, who can access them and under what transfer mechanism. Check each answer in the vendor's current contract and documentation, because model hosting options and terms change.

Why it is a transfer question

A prompt with personal data that is sent to a processor in a third country is a transfer, and so is remote access to stored prompts by staff there. The same EDPB logic applies as for any cloud service: you must know where data may be located or processed. See what counts as a transfer.

The checklist

1. Inference location. In which region is the model run for your requests? Is region selection a setting or a contract term?
2. Storage location. Are prompts, outputs and logs stored, and where?
3. Retention. How long, and can you set it to zero where offered?
4. Training use. Is your data used to train models? Get the answer in writing. See answering the training question in questionnaires.
5. Human review. Can vendor staff read prompts, for abuse checks or support, and from which countries?
6. Sub-processors. Which ones, where, and how are changes notified?
7. Transfer mechanism. What is the basis for any data leaving the EEA?
8. Processor terms. Is there a data processing agreement meeting Article 28? See the DPA checklist for LLM API vendors.
9. Failover. Does traffic fail over to another region during outages? A fallback endpoint can break your residency promise silently.
10. Fine tuning and embeddings. Where are custom models, vector stores and uploaded files kept?

Reduce what you send

• Strip names, emails and identifiers before the call where the task allows.
• Replace identifiers with tokens and map them back after.
• Send only the fields the task needs.

The EDPB says that when a processor needs data in the clear, encryption alone will not solve a transfer problem, so minimisation does real work here.

Engineering controls

• Route all AI calls through one internal client so region, retention and redaction settings live in one place.
• Log the endpoint region used for each call.
• Add an alert if a call goes to an unapproved endpoint.
• Test failover behaviour in staging.

A note on retrieval and agents

If your feature uses retrieval, the documents you fetch and place in the prompt are also data sent to the model endpoint, so apply the same checks to that path. If an agent can call tools, check where each tool's data goes too, since the model may pass personal data from one system into another. Log tool calls so you can reconstruct what left your boundary.

When to say no

If a vendor cannot answer the location, access and retention questions in writing, hold the launch for features that handle personal data. A short delay costs less than rebuilding the integration after a customer review fails.

Quick check

Sources

• EDPB Recommendations 01/2020

This is educational content, not legal advice.

Last reviewed: 19 October 2026.