Assessing privacy risks of proprietary and open-weight large language models: A GDPR-oriented comparative analysis
Year: 2026
Type: article
Abstract: This study examines the growing privacy risks posed by Large Language Models (LLMs) through a structured, General Data Protection Regulation (GDPR)-oriented comparative analysis. As LLMs increasingly process personal data across sectors, understanding their alignment with the proposed GDPR-based evaluation dimensions is essential for responsible adoption and risk mitigation. Using a multi-criteria evaluation framework informed by the literature, six leading LLMs (GPT-4/5, Claude 3, Gemini, Llama 3, Mistral, and Falcon) were assessed across six GDPR-based evaluation dimensions. Weighted scoring enabled a transparent comparison of privacy governance maturity across the evaluated models. Findings indicate strong performance in security and risk-based controls, particularly among proprietary models, while notable gaps remain in Purpose Limitation, Data Minimization, and documentation of lawful bases. Proprietary models generally demonstrated higher privacy governance maturity, whereas open-weight models benefited from community scrutiny but lacked structured documentation and enterprise accountability. Data Subject Rights exhibited mixed support across all evaluated models, reflecting technical challenges in implementing access, rectification, and erasure within machine learning contexts. This study contributes an actionable framework for organizations, policymakers, and researchers seeking to align Artificial Intelligence (AI) deployment with GDPR requirements. Future research should focus on longitudinal assessments of evolving LLM policies, the development of AI-specific regulatory guidance to address ambiguities in the GDPR, and the creation of standardized benchmarks for evaluating privacy governance in foundation models.
Authors: Yehia Ibrahim Alzoubi, Alok Mishra
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: gold
Estimated APC paid: $1,560
OpenAlex ID: W7204480648