Third-country transfers and AI: when a pseudonymisation proxy is not enough

When is an AI request a third-country transfer?

Chapter V of the GDPR (Art. 44 to 49) governs when personal data may go to recipients outside the EU and the EEA: on the basis of an adequacy decision, of appropriate safeguards such as standard contractual clauses, or of a derogation under Art. 49. If an AI model runs at a provider in the US, or if such a provider has technical access to the requests, this is a transfer as soon as the data is personal data for that provider.

A pseudonymisation proxy is meant to avoid exactly that: it replaces names and identifiers before the text leaves your organisation (how the technology works). Whether that is enough depends on the role of the recipient and on the specific text.

Which situation has which consequence?

Situation	Consequence
Original data goes to a US provider	personal data; check Chapter V GDPR
Pseudonymised; the model provider computes on your behalf	under the draft Guidelines 02/2026, personal data for the provider too; Chapter V applies
Pseudonymised; the recipient can tell from context, metadata or linked requests who is concerned	still personal data; the third-country rules apply
Demonstrably anonymous for an independent recipient	can fall outside the third-country rules; the processing before it remains regulated
A proxy in the EU processes the original and passes on only demonstrably anonymous data	the proxy remains bound by the GDPR; the disclosure must be assessed separately
A proxy or model in protected hardware receives identifiable content	the hardware removes neither the personal nature of the data nor the third-country obligations

What do the CJEU and the data protection authorities say?

CJEU: In its judgment C-413/23 P of 4 September 2025, the Court held that pseudonymised data is not personal data in every case and for every person. Effective pseudonymisation can prevent parties other than the controller from identifying people. For the controller itself, the data remains personal data.

Guidelines 02/2026 (draft): On 7 July 2026, the European Data Protection Board adopted a draft on anonymisation; the consultation runs until 30 October 2026. Two statements matter for AI providers in third countries:

• A party processing on behalf of another is assessed from the other’s perspective (para. 15). If the data is personal data for you, it is also personal data for the model provider computing on your behalf.
• If it is reasonably likely that a recipient will pass the data on to a third party able to attribute it, the data counts as personal data for that disclosure and for the further processing (para. 21).

Recommendations 01/2020: The recommendations on supplementary measures for transfers (version of 18 June 2021) already treat pseudonymisation as a possible safeguard if the exporter can prove that the data cannot be attributed to a person, even with information that authorities in the recipient country might hold. For providers that need access to plain text to perform their task, the Board found no effective technical supplementary measure there.

Why is the proof hard for AI requests?

Free text often contains details that together make a person recognisable, even without a name. A made-up example: “PATIENT_17, 43, Starnberg, rare metabolic disorder” names nobody, but in a small town it may be enough. Add metadata such as the sending organisation, the time and the account identifier, which the model provider receives anyway, and stable placeholders that allow several requests about the same person to be linked (re-identification).

What should you check?

1. Role of the model provider: Does it process on your behalf (data processing agreement), or is it an independent recipient?
2. Transfer basis: Is the provider certified under the EU-US Data Privacy Framework (Implementing Decision 2023/1795), or do standard contractual clauses with a transfer impact assessment apply?
3. Residual risk: Can you prove for your type of text that singling out, linking and inference do not succeed?
4. Other paths: Do attachments, logs or web search bypass the proxy and go to the third country?
5. Access by authorities: If the provider is subject to US law, the US CLOUD Act also applies to data centres in Europe (US CLOUD Act).
6. Professional secrecy: For patient or client data, § 203 StGB (German Criminal Code, professional secrecy) applies as well.

How does basebox handle this?

basebox is a German company; the platform and the AI model run on a server in your organisation or in our cloud in the München-Ost data centre (Munich). By default, basebox does not send your data to any AI model of another provider, and the US CLOUD Act does not apply to the AI model in basebox. The optional app with an external model is different: it runs on Google Vertex in the EU; because Google is a US company, the CLOUD Act applies there. Whether you use it, and for which data, is something you decide with your data protection officer (details).

Not legal advice: This article gives an overview as of 11 October 2026. Guidelines 02/2026 are a draft under consultation; the adequacy decision on the Data Privacy Framework can be reviewed by the courts. Check your transfers with your data protection officer.