GDPR and LLM egress: mask PII before OpenAI, Claude, or Gemini

GDPR does not ban LLMs. It requires lawful basis, purpose limitation, and appropriate technical measures. For engineering teams, the highest-leverage measure is stop shipping personal data to the model unless strictly necessary — mask first, document second. The same mask-before-egress pattern maps to KVKK-oriented programs in Turkey (TCKN is already a core detector when enabled) — orientation, not certification.

Practical engineering checklist

• Map which features send user text to which LLM vendor.
• Insert maskPii in your backend before every third-party LLM call.
• Keep vault mappings on your side; providers see [EMAIL_1], not the email.
• Align detector packs with legal (IBAN, national ID, health identifiers) via dashboard policy.
• Review security overview with your DPO — this guide is not legal advice.