From 4159b1603fad4464149f39a5cb7481b3f08cdb06 Mon Sep 17 00:00:00 2001 From: Bipin Rimal Date: Sat, 21 Mar 2026 02:43:26 +0545 Subject: [PATCH] fix: Qualify GDPR processor role as provider-dependent --- docs/my-website/docs/eu-ai-act-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/my-website/docs/eu-ai-act-compliance.md b/docs/my-website/docs/eu-ai-act-compliance.md index d2dc79342e3..4e2f3dec405 100644 --- a/docs/my-website/docs/eu-ai-act-compliance.md +++ b/docs/my-website/docs/eu-ai-act-compliance.md @@ -55,7 +55,7 @@ graph LR class Azure processor ``` -Every provider is a **processor** under GDPR: they process data on your behalf. Each requires a Data Processing Agreement (Article 28). +Providers are typically processors for customer-submitted data, but the exact role depends on each provider's terms of service and processing purpose. Deployers should review each provider's DPA. Each requires a Data Processing Agreement (Article 28). When you self-host LiteLLM, your organization is the data controller — you determine the purpose and means of processing. LiteLLM as software has no GDPR role; the legal designation applies to the organization operating it. When using LiteLLM's hosted proxy service, the organization operating that service becomes an additional data processor.