DPA case 18/2025 – Violation Found (Greece, 2025)

Hangzhou DeepSeek Artificial Intelligence Co. (DeepSeek) is a company established in China that provides an LLM platform called ‘DeepSeek AI’, to data subjects located in Europe. The Hellenic DPA initiated ex officio investigations against DeepSeek for the services provided in the EU and particularly in Greece. The DPA addressed a letter to DeepSeek reminding them that they fall within the scope of the GDPR according to Article 3(3) GDPR and have an obligation to a appoint a representative in the EU in writing pursuant to Article 27 GDPR. The DPA also addressed them a number of questions in order to determine their compliance with the GDPR, regarding the lawfulness of processing, the processing activities and the legal basis for each processing activity of personal data of data subjects located in Greece, their obligation to ensure that data subjects can exercise their rights and the location of the data centres used for hosting and providing the DeepSeek software. DeepSeek denied offering services in the EU and therefore falling within the scope of the GDPR, but stated that they are willing to accept the DPA's advice and guidance on this obligation. DeepSeek answered the questions vaguely without mentioning all relevant provisions of the GDPR and stated that they store data in China, without mentioning the establishment of additional legal safeguards. Furthermore, DeepSeek’s privacy policy does not make any reference to the GDPR and uses unclear wording. After examining all relevant information, the DPA issued a decision. First, the DPA held that the services offered by DeepSeek are undoubtedly addressed and targeted to EU data subjects and therefore DeepSeek falls within the scope Article 3(3) GDPR. DeepSeek, acting as a controller, makes clear its intention to offer services to data subjects located in the EU and in particular to Greece, as it is accessible both via the internet and through mobile applications to data subjects located in Greece and the ap