Chinese AI models: how does DeepSeek as an app differ from locally run model weights?

Chinese AI models became a practical concern for European organisations when DeepSeek was launched in January 2025 and rapidly acquired a large user base. On 30 January 2025 the Italian data protection authority, the Garante, ordered an immediate limitation of the processing of Italian users’ data, and on 27 June 2025 the Berlin data protection authority reported the DeepSeek app to Apple and Google as illegal content. The Norwegian National Security Authority (NSM) has concluded that the risks of the app weigh against allowing it on work devices. The legal assessment nevertheless depends on how a model is used. The same models are available as an app, through an application programming interface (API) and as open model weights that can be run on an organisation’s own infrastructure. The questions addressed below are when use involves a transfer of personal data to China, what risk remains when the weights are run locally, and what organisations should require of their suppliers. The wider transfer rules are covered on the data protection topic page.

Which Chinese AI models are relevant, and how are they used?

The Chinese AI models most widely used in Europe come from DeepSeek and from Alibaba, which develops the Qwen models. Both offer their own services in which users interact directly with the model, and an API that other software suppliers can integrate into their products. Both have also published model weights that anyone may download. DeepSeek-R1 is released under the MIT licence, which according to the model card permits commercial use, modification and derivative works. Several Qwen models are released under the Apache 2.0 licence.

The model weights are the numerical parameters that constitute the model itself. Where the weights are run on an organisation’s own servers or by a cloud provider of its choosing, no data is returned to the developer of the model. It is therefore necessary to distinguish between three modes of use, namely the developer’s own service, the developer’s API and self-hosting of the open weights. The legal assessment differs for each.

Does use of the DeepSeek app or API involve a transfer to China?

Use of DeepSeek’s own service involves a transfer of personal data to China. According to DeepSeek’s privacy policy, last updated on 10 February 2026, personal data is collected, processed and stored “in People’s Republic of China”. The controller is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., which has appointed Prighter Group as its representative in the EU under Article 27 GDPR. Such a representative is a point of contact for supervisory authorities and data subjects. It does not make DeepSeek an organisation established in the EEA and does not provide a basis for the transfer.

A transfer to a third country requires a mechanism under Chapter V of the General Data Protection Regulation (Article 44 GDPR). The European Commission has not adopted an adequacy decision for China. The transfer must therefore rest on appropriate safeguards under Article 46 GDPR, such as standard contractual clauses. Following the judgment of the Court of Justice in Case C-311/18 (Schrems II), the exporter must also assess whether the law of the recipient country prevents those safeguards from operating as intended, and adopt supplementary measures where necessary.

The Berlin authority concluded that DeepSeek infringes Article 46(1) GDPR because the company had not demonstrated that data from German users is protected at a level essentially equivalent to that guaranteed under EU law. The authority first asked DeepSeek to withdraw the app or comply with the conditions for transfer, and then reported the app to Apple and Google under Article 16 of the Digital Services Act (DSA). The Garante had already in January 2025 found DeepSeek’s answers entirely insufficient and rejected the company’s position that EU law did not apply to it. The regulation applies to a controller outside the EEA that offers services to individuals in the EEA (Article 3(2) GDPR).

In our assessment, a European organisation will find it difficult to use DeepSeek’s app or API with personal data lawfully. The provider needs access to the content in clear text in order to respond, so technical measures such as encryption cannot prevent access by authorities in the recipient country. The privacy policy also allows user input to be used to train and improve the models, subject to a right to opt out. The same applies in principle where a software supplier integrates DeepSeek’s API into a service the organisation buys, since the data is then transferred onwards from the supplier to DeepSeek.

What has the Norwegian National Security Authority said about DeepSeek?

NSM has not issued specific guidance on DeepSeek, but discusses the app in its report on mobile applications on work devices, last updated on 21 May 2025. NSM notes that the terms of use state that all interaction with the app, and other information it collects from the device, is stored in China, and that Chinese law gives the Chinese authorities access to that information. NSM also points out that communication between the app and the service provider is not secured against interception and manipulation. Its conclusion reads as follows in our translation.

All of these are risk factors supporting an assessment not to permit installation of the application on work devices.

The report proceeds on the basis that each organisation must assess applications as part of its own security work. For organisations subject to the Norwegian Security Act, that assessment forms part of their preventive security work. Other organisations should use the NSM assessment as a starting point when deciding which AI services employees may use. Internal rules on this subject are discussed in the article on AI policies for employees.

How does the risk change when Chinese AI models are run locally?

Where the open weights are run on the organisation’s own infrastructure, no personal data is transferred to China through use of the model. The same applies where a cloud provider within the EEA hosts the model for the organisation, provided that the provider does not itself transfer data outside the EEA. The transfer assessment then follows the party that actually processes the data. The Chinese origin of the model has no bearing in itself on whether Chapter V GDPR applies.

The risk shifts instead to the supply chain and to the content of the model. In Risiko 2025, NSM warned that malicious actors may upload models containing backdoors to sharing platforms such as Hugging Face, and that model files may execute malicious code when downloaded. A model may also carry restrictions or biases from its training that are not visible to the user. These risks are not unique to Chinese models, but they make it important to know where the weights were obtained and to test the model against the tasks for which it will be used.

What should organisations require of their suppliers?

Contracts with software and AI suppliers should specify which models and model providers the service may use. Many services rely on one or more language models accessed through an API, and a supplier can change the model without any visible change in the user interface. Where the model provider processes personal data on the customer’s behalf, it is a sub-processor. The data processing agreement should therefore give the customer a right to prior notice of and objection to any change, as discussed in the article on SaaS data processing agreements.

The contract should also state the place of processing for all inference and prohibit transfers to countries without an adequacy decision unless the customer has given written consent. Where the supplier uses open weights, it should document where the weights were obtained, how their integrity was verified and what testing the model has undergone. For high-risk processing, the choice of model and place of processing must form part of the data protection impact assessment, as described in the article on DPIAs for AI tools.

What should organisations do?

Organisations should distinguish between the three modes of use in their internal rules and supplier contracts, because a general prohibition on Chinese AI models may exclude lawful local use while failing to capture suppliers that use DeepSeek’s API in the background. The following steps should be taken.

1. Provide in internal rules that the own services of DeepSeek and other Chinese developers must not be used with personal data, trade secrets or confidential information.
2. Map which AI models and model providers existing SaaS services rely on, and obtain written confirmation of the place of processing.
3. Include in new contracts a list of approved models and an obligation on the supplier to give notice before any change of model.
4. Require documentation of source, integrity checks and testing before open model weights are deployed on in-house infrastructure.
5. Block installation of the DeepSeek app on work devices in line with the NSM assessment, where the organisation manages its devices centrally.

Questions and answers

Next legal review: 31 March 2027