--- title: "LLM Pseudonymization Gateway and GDPR Scope" canonical: https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/ language: en description: "A pseudonymization gateway does not remove you from GDPR scope. What the 2025 CJEU ruling and EDPB guidance require before you buy one, plus vendor questions." image: "https://wavect.io/img/blog/headers/header_llm-pseudonymization-gateway-gdpr-2026.png" --- [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 13 min read · 18 Aug 2026 Last reviewed August 18, 2026 [**Next**](/blog/pii-redaction-before-llm-prompts/) # LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope? TL;DR A pseudonymization gateway sits between your users and a hosted model, replaces identifying values with placeholders on the way out and restores them on the way back. It does not take you out of GDPR scope. Article 4(5) assumes the additional information still exists, and the EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data attributable through that information is personal even when the two are held by different people. What changed on 4 September 2025 is the recipient side: in Case C-413/23 P the Court of Justice held that pseudonymised data must not be regarded as personal data in all cases and for every person, while confirming that the controller's information duty is assessed at collection and from the controller's own point of view. So the gateway can move the model provider out of scope, not you, and only on the facts. The EDPB test for that sits in paragraphs 63 to 68: the additional information must be unreachable for authorities in the recipient country, held exclusively by the exporter or a trusted EEA entity, and the prompt must not let anyone single out a person. The third condition is where the category breaks, because ETH Zurich research shows models infer location, income and sex from ordinary text at up to 85 percent top-1 accuracy. Buy the gateway for one enforcement point on model choice, retention and logging, test it on 200 of your worst prompts, write the mapping-store architecture down on one page, and route prompts that cannot be de-identified to an EU-hosted or self-hosted model instead. Sources reviewed 18 August 2026. **A pseudonymization gateway does not take you out of GDPR scope. At best it takes the model provider out of scope, and that is a narrower claim you have to be able to prove.** The category sells one implicit promise: route the prompt through a pseudonymizer, and sending it to a hosted model stops being a data protection problem. Since 4 September 2025 that promise has a precise legal shape, and the shape is more useful than the marketing, because it tells you exactly which evidence a buyer has to collect. On that date the Court of Justice held, in [Case C-413/23 P, EDPS v SRB](https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250107en.pdf), that "pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data". Read the second half of that sentence carefully. The data can remain personal for you while ceasing to be personal for the recipient. Your obligations do not move. The recipient's status might, if the facts support it. This page owns the buy-side question: what a bought pseudonymization platform changes about your legal position, and what evidence you need before you rely on it. Our [PII redaction pipeline guide](/blog/pii-redaction-before-llm-prompts/) owns how to build the detection and placeholder layer with Presidio, Privacy Filter or managed DLP. Our [EU data residency guide](/blog/eu-data-residency-ai-apps-2026/) owns where the model itself runs, and our [GDPR and AI Act stacking guide](/blog/gdpr-ai-act-stacking-dach-saas/) owns the artifact list a DACH product team has to ship. Sources reviewed on 18 August 2026. ## What is a pseudonymization gateway for LLMs? **It is a control point that sits between your users and one or more hosted models, replaces identifying values with placeholders on the way out, and restores them on the way back.** The mechanism is three steps, and every product in the category implements the same three. 1. **Detect and replace.** Names, addresses, customer numbers, account identifiers and free-text mentions are found and swapped for typed placeholders. 2. **Call the model.** The placeholder-bearing prompt goes to the provider. The provider never sees the original values, only the tokens. 3. **Restore.** The response comes back, placeholders are mapped to the original values, and the user sees a complete answer. Products differ in packaging, not in mechanism. Some sell it as an API you put in front of your own application. Some sell a finished chat product with the gateway inside. [Pryvet](https://www.pryvet.ai/), a German platform in this category, is a useful worked example because it publishes enough detail to inspect. Its [published pricing page](https://www.pryvet.ai/tarife/) starts at 29 euros per user per month with contingents from ten employees, and it groups the selectable models by server location into German, European and US-American, with GPT-5.2, Gemini 2.5 Pro, Claude Opus 4.7 and Alibaba Qwen in the third group. Its [trust center](https://www.pryvet.ai/trust-center/) lists the subprocessors behind that, including T-Systems, Microsoft Azure, AWS, MongoDB Atlas and Auth0 on the infrastructure side and Anthropic, OpenAI, Google, Mistral, DeepSeek and Alibaba Qwen on the model side. That model grouping is the most honest thing on any vendor page in this category, and it is the reason the legal analysis below matters. The gateway is the control. The destination is still a choice you make per request, and a US-hosted destination is still a Chapter V transfer of whatever actually leaves your building. **Independence and trademarks:** Wavect publishes this page and is itself a provider, so we have a commercial interest in it. We are not affiliated with, endorsed by or partnered with the other companies named here, and all third-party company names, brands and trademarks are the property of their respective owners. Statements about other providers are taken from publicly available sources, primarily their own published pages, as of the review date shown on this page, and may have changed since. Please verify them directly before you decide. This page was written to the best of our knowledge and with the intent to remain objective. If you believe anything here is inaccurate or unfair, write to us and we will correct it: [office@wavect.io](mailto:office@wavect.io) | What the layer does | What it does not do | | --- | --- | | Reduces the data the provider receives to placeholder-bearing text | Remove you from the controller role or from any controller duty | | Gives you one enforcement point for logging, retention and model choice | Anonymize the data, in the GDPR sense, for you | | Makes an accidental paste of a customer record less damaging | Stop a free-text prompt from singling out a person by context | | Can support a transfer impact assessment as a supplementary measure | Replace the transfer mechanism itself | | Creates an audit trail your data protection officer can actually read | Cover attachments, screenshots or voice unless the vendor says it does | ## Does pseudonymization take a prompt out of GDPR scope? **Not for you, and that is settled.** Article 4(5) GDPR defines pseudonymisation as processing after which the data can no longer be attributed to a data subject without additional information, provided that additional information is kept separately. The definition assumes the additional information still exists. If it did not, you could not restore the answer, and the product would not work. The [EDPB Guidelines 01/2025 on Pseudonymisation](https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf) put it directly at paragraph 22: pseudonymised data that could be attributed to a natural person by the use of additional information is personal, and that "holds true if pseudonymised data and additional information are not in the hands of the same person". Erasing the mapping later does not retroactively help either. The guidelines say the data becomes anonymous "only if the conditions for anonymity are met", which is a separate and much higher bar. What the CJEU added in 2025 is the recipient half of the picture. Identifiability is assessed per actor and per situation, so the same bytes can be personal data for the party holding the key and not personal data for a party that cannot realistically get it. The Court also confirmed the limit of that idea in the same judgment: your duty to inform people about recipients is assessed at the time of collection and from your point of view, before any pseudonymisation happens. | Party | Is the prompt personal data for them | What follows | | --- | --- | --- | | You, the deploying company | Yes, always. You hold or control the mapping | Full controller duties: legal basis, information, retention, DPIA where required, records | | The gateway vendor | Yes, if it holds or can reach the mapping | Processor under Article 28, with a data processing agreement and a subprocessor list | | The model provider | Possibly not, on the facts | This is the only part the gateway can actually change, and only with evidence | | A public authority in the provider's country | Assessed separately | The EDPB test below is written for exactly this actor | Two caveats belong in any memo that cites this. The Court set aside the General Court's judgment and referred the case back, so the litigation is not finished. And the EDPB pseudonymisation guidelines carry the header "Adopted - version for public consultation", adopted on 16 January 2025 with the consultation closing on 28 February 2025. Both are the best available authority today. Neither is a final word, and a claim built on them needs a review date. ## What would you have to prove for the model provider to be outside scope? **The EDPB has already written the test, and most buyers have never read it.** Paragraphs 63 to 68 of the guidelines describe when pseudonymisation works as a supplementary measure for a third-country transfer. Three conditions have to hold together. | EDPB condition | What it means for an LLM API call | How hard it is | | --- | --- | --- | | Attribution requires additional information that authorities in the recipient country neither possess nor can obtain with reasonable effort | The mapping must never travel with the prompt, and must not be derivable from it | Achievable by design, and the one thing every vendor in the category already claims | | The additional information is held exclusively by the exporter, or by a trusted entity in the EEA or an essentially equivalent jurisdiction, kept separately | Ask where the mapping store physically lives, who operates it, and whether any US-parent subprocessor can reach it | Contractually and architecturally checkable, and often the question that changes the answer | | Those authorities cannot single out a data subject in the course of an interaction with members of a group, using the pseudonymised data plus what they can obtain with reasonable effort | The prompt text itself must not narrow the population to one person | The hard one, and the reason the next section exists | Paragraph 70 adds the rule that applies even without a transfer question: before transmitting pseudonymised data to a third party, at minimum identify the means available to that recipient for attribution. For a frontier model provider that means being explicit about what the provider already holds, including your other traffic, and about retention on their side. A gateway that reduces the prompt but leaves a stable per-user identifier in the metadata has not passed this test. ## Why free text defeats field-level pseudonymization **Replacing names is easy. Preventing a prompt from describing exactly one person is not.** This is where the "cannot single out" condition breaks in practice, and the evidence is uncomfortable for the whole category. Researchers at ETH Zurich showed in [Beyond Memorization: Violating Privacy Via Inference with Large Language Models](https://arxiv.org/abs/2310.07298) that current models infer personal attributes such as location, income and sex from ordinary text, reaching up to 85 percent top-1 and 95 percent top-3 accuracy, at roughly one hundredth of the cost and one two-hundred-fortieth of the time a human needs. The attack surface is not the name field. It is the writing. The EDPB anticipates the same problem from the other direction. Paragraph 21 of the guidelines says information beyond your control, "for example, information from publicly accessible sources, such as posts in a social media or an online forum", counts toward attribution and must be considered in your assessment of whether the pseudonymisation is effective. In real prompts, the residue that survives a good field-level pass usually looks like this. - **Role plus organisation plus event.** "Our interim CFO who started in March at the Innsbruck site" identifies one person without a single named entity. - **Rare combinations.** A diagnosis, a postcode and an age band. None is a name. Together they are a person. - **Quoted correspondence.** Writing style, salutation habits and internal shorthand travel with a pasted email even after the header is stripped. - **Attachments and screenshots.** A gateway that parses structured text may pass an image through untouched. Ask explicitly, because screen content cannot be redacted the way a form field can. - **Retrieval context.** If the assistant does RAG, the retrieved chunks are prompt content too. Permission-aware retrieval is a separate control, covered in our [RAG permissions guide](/blog/rag-permissions-sharepoint-confluence-drive/). None of this makes the gateway pointless. It makes the claim conditional on your corpus. A ticket queue of "printer on floor 3 is jammed" pseudonymizes cleanly. An HR grievance thread does not, and no amount of placeholder engineering will change that. The honest architecture decision is to route the second category somewhere else rather than to buy a stronger detector. ## Eight questions to ask a pseudonymization platform vendor These are ordered by how often the answer changes a decision, not by how they sit in a security questionnaire. Our [AI vendor security questionnaire](/blog/ai-vendor-security-questionnaire-eu/) covers the generic layer underneath them. 1. **Where does the mapping live, and who can read it?** Name the jurisdiction, the operator and the access path. The EDPB condition is exclusivity, so "our cloud" is not an answer and "a hyperscaler region in Germany" only becomes one once you know who holds the keys. 2. **Is pseudonymization on by default, or is it a tier feature?** Worth asking of every product. On Pryvet's published matrix, for instance, the Professional tier lists automatic deletion and pseudonymisation of personal data as optional, while the Enterprise tier adds sensitive data and an optional custom ruleset. A control that a user can switch off is a control your policy has to enforce elsewhere. 3. **Which model, in which country, for this request?** A platform that lets a user pick a US-hosted model has handed the transfer decision to the user. Decide whether that is acceptable, then enforce it with configuration rather than with training. 4. **What exactly do you send besides the prompt?** Tenant identifiers, user identifiers, session identifiers and system prompts all travel. Stable per-user identifiers defeat the singling-out condition on their own. 5. **What is retained, by you and by the model provider?** Ask for the retention setting per provider, in writing, and for what happens to the mapping store when a chat is deleted. 6. **What is in scope for detection, and what is passed through?** Structured fields, free text, tables, PDFs, images, audio. Ask for the false-negative rate on German compound names and on Austrian and Swiss formats, not on an English benchmark. 7. **Who is the processor, and what does the DPA actually say?** Article 28 contract, current subprocessor list, notification period for changes, and audit rights. A published subprocessor list, as Pryvet maintains, is the minimum bar rather than a differentiator. 8. **What evidence do you hand me for my own file?** A transfer impact assessment input, an architecture description of the pseudonymisation domain, and the results of the last penetration test. If the vendor cannot produce these, you will write them yourself, and that cost belongs in the comparison. ## What stays yours no matter which platform you buy **Every duty in this table survives the purchase.** Vendors are not being dishonest about this; buyers simply read a compliance badge as a transfer of responsibility, and it never is one. | Obligation | Why the gateway does not absorb it | | --- | --- | | Controller role and legal basis | You decide the purpose and means. Pseudonymisation is a measure under Articles 25 and 32, not a basis | | Information duty at collection | The CJEU assessed this from the controller's perspective, before any pseudonymisation | | DPIA where the processing is high risk | Risk reduction is an input to the assessment, not a replacement for it | | Transfer mechanism and transfer impact assessment | Pseudonymisation is a supplementary measure on top of Article 46 safeguards, not instead of them | | Records of processing and retention | Chat history is processing. Set the period and make the platform enforce it | | AI Act duties that already apply | Article 4 AI literacy applies now, and transparency duties from 2 August 2026. See our [Article 50 checklist](/blog/eu-ai-act-article-50-checklist/) | | An internal rule people can follow | The control only works if staff use the gateway. Our [one-page AI policy](/blog/ai-policy-one-page-dach/) is the shortest version that holds | ## Buy the gateway, move the model, or keep the data out? Four options, and the gateway is only the best answer in one band. Cost modelling for the alternatives is in our [self-hosting cost analysis](/blog/self-hosting-llms-eu-cost/) and our [internal assistant cost breakdown](/blog/internal-ai-assistant-cost-dach/). | Option | When it wins | What it costs you | | --- | --- | --- | | Send no personal data at all | The task is drafting, summarising public material or code. Most internal AI value sits here | Scope discipline and a routing rule. Cheapest control by a wide margin | | Pseudonymization gateway plus a hosted model | Mixed traffic, many casual users, and you want one enforcement point fast | Per-seat licence, residual singling-out risk, and the evidence work above | | Model served from a contractually fixed EU processing region | The data is personal and the prompts are inherently identifying | A smaller model menu, a real capability gap on the hardest tasks, and the work of verifying the region instead of the vendor's address | | Self-hosted open-weight model | High volume, regulated sector, or data you cannot send anywhere | GPU spend plus the engineer-time floor, which is the part teams underestimate | That third row says processing region, not nationality, on purpose. A provider's corporate domicile tells you which company law it lives under, not where a given request is served, and a European vendor can still run inference in a third-country region or on a third-country cloud. Pin the region in the contract, per model and per endpoint, and get it in writing that it does not silently fail over. A European brand with an unspecified processing location leaves you with exactly the Chapter V question you were trying to avoid. In practice the good answer is usually two of these at once: a hard rule that most work never carries personal data, plus one governed path for the work that does. That is the shape we built for [PromptID](/case-studies/promptid/), where model-agnostic calls run behind a single orchestration layer, so the provider is a configuration decision rather than an architectural commitment. If you are still choosing between a platform and a build, our [custom software versus off-the-shelf guide](/software-development-guide/custom-software-vs-off-the-shelf/) is the neutral version of that decision. ## A two-week evidence pilot Do not evaluate this category on a demo. Evaluate it on your own worst prompts, and end with a file you can hand to a data protection officer. 1. **Build a 200-prompt corpus from real traffic**, weighted toward the ugly cases: HR, legal, support escalations, anything with an attachment. 2. **Run the singling-out test.** Take the pseudonymised output and ask a strong model to describe who wrote it and about whom. Count how often the population narrows below ten people. 3. **Measure false negatives by category**, separately for German, Austrian and Swiss formats, and separately for free text and structured fields. 4. **Measure the task-quality delta.** Placeholders change answers. Score the same tasks with and without the gateway, because a compliant assistant nobody uses is not a control. 5. **Log latency and cost per request** through the gateway against the direct call. Two model round trips are common in this category. 6. **Write the mapping-store architecture down** in one page: location, operator, access, retention, deletion. This is your pseudonymisation domain, and it is the document the EDPB test is graded against. 7. **Decide the routing rule** that survives the pilot: which prompt classes go to the gateway, which go to an EU-hosted model, and which never leave. ## Pseudonymization and LLM prompts FAQ ### Is pseudonymized data still personal data under GDPR? For the party that holds or can reach the additional information, yes. The EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data which could be attributed to a natural person by use of additional information is personal, and that this holds even when the data and the additional information are not in the hands of the same person. Since the CJEU judgment of 4 September 2025 in C-413/23 P, the same data may nonetheless not be personal data for a recipient who cannot realistically re-identify anyone. ### Does a pseudonymization gateway make an LLM GDPR compliant? No. Compliance is a property of your processing, not of a tool. The gateway can reduce what the model provider receives and can serve as a supplementary measure supporting a third-country transfer, but you remain the controller with the legal basis, information duty, DPIA, records and retention obligations. No vendor certification transfers those. ### Can pseudonymization replace standard contractual clauses? No. The EDPB treats pseudonymisation as a supplementary measure on top of an Article 46 transfer tool, not as a substitute for it. Paragraphs 63 to 68 of the guidelines list the conditions under which it strengthens such a transfer, including that the additional information is held exclusively by the exporter or a trusted entity in the EEA or an equivalent jurisdiction. ### What did the CJEU decide in EDPS v SRB? On 4 September 2025 the Court held that personal opinions are personal data because they are inherently linked to their author, that pseudonymised data must not be regarded as personal data in all cases and for every person, and that whether a data subject is identifiable must be assessed at the time of collection and from the controller's point of view for the purposes of the information duty. The Court set aside the General Court's judgment and referred the case back, so the proceedings continue. ### Is pseudonymization the same as anonymization? No. Pseudonymisation keeps the additional information that allows attribution, which is what lets a gateway restore the answer. The EDPB is explicit that even erasing the mapping makes the data anonymous only if the separate conditions for anonymity are met. Marketing that uses the two words interchangeably is a signal to read the technical documentation more carefully. ### Do placeholders reduce answer quality? Sometimes, and it is measurable. Typed and stable placeholders such as PERSON_1 preserve more coreference than a uniform redaction marker, but tasks that depend on real-world knowledge about the entity will degrade. Score the same task set with and without the gateway before you roll it out, because an assistant people route around provides no protection at all. ### What should a pseudonymization gateway cost? Per-seat platform pricing in this category currently starts in the region of 29 euros per user per month for entry tiers, with enterprise pricing on request. The licence is rarely the deciding number. The real comparison is licence plus the evidence work you would otherwise do yourself, against the cost of an EU-hosted model or a self-hosted deployment for the traffic that actually carries personal data. ## Final thoughts Treat the pseudonymization gateway as what it is: a good engineering control and a weak legal shield. It gives you one place to enforce model choice, retention and logging, and it makes an accidental paste survivable. It does not make you a smaller controller, and it only removes the model provider from scope if your prompts genuinely stop singling people out, which is a property of your text rather than of the vendor's detector. Buy it for the enforcement point, test it on your worst prompts, write the mapping-store architecture down on one page, and keep the traffic that cannot be de-identified on a path that never needed the gateway in the first place. ## Primary sources - [Court of Justice of the European Union, press release 107/25 of 4 September 2025 on Case C-413/23 P, EDPS v SRB](https://curia.europa.eu/en/) - [EDPB Guidelines 01/2025 on Pseudonymisation, consultation page, adopted 16 January 2025](https://www.edpb.europa.eu/public-consultations/guidelines-012025-on-pseudonymisation_en) - [Regulation (EU) 2016/679, GDPR, including the Article 4(5) definition of pseudonymisation](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [ETH Zurich SRI Lab, Beyond Memorization: Violating Privacy Via Inference with Large Language Models](https://www.sri.inf.ethz.ch/publications/staab2023beyond) - [Pryvet security page, on pseudonymisation before processing and German or European server processing](https://www.pryvet.ai/sicherheit/) ## You may also like.. [**PII redaction before LLM prompts** The build side of the same control: detection, typed placeholders, tool choice and how to test the pipeline.](/blog/pii-redaction-before-llm-prompts/) [**EU data residency for AI apps** Where the model runs, what each provider actually commits to, and the decision tree behind it.](/blog/eu-data-residency-ai-apps-2026/) AI governance and regulation ## Continue through this cluster Security, policy, compliance and operating controls for responsible AI adoption. [Start with the cornerstone**EU AI Act Cost for a 5-Person Startup**](/blog/eu-ai-act-compliance-cost-startup/) - [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/) - [AI Agent Contract Signing: eIDAS QES Integration Guide](/blog/ai-agent-eidas-signature-integration/) - [Terafab: Who Controls the AI Stack From Silicon to Orbit?](/blog/terafab-vertical-integration-ai-stack/) - [Can AI Create Viruses? What Stanford Actually Proved](/blog/ai-designed-viruses-stanford-biosecurity/) - [Stripe Billing and E-Invoicing 2027](/blog/stripe-billing-e-invoicing-2027/) Inbox, without the noise ## Follow the work that matters to you Get a short email when we publish something new. Follow the whole blog or only the problems you care about. [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 13 min read · 18 Aug 2026 Last reviewed August 18, 2026 [**Next**](/blog/pii-redaction-before-llm-prompts/) New posts by email × × Get new posts by email A short email when we publish. Free, no tracking. ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/#webpage", "@type": "WebPage", "dateModified": "2026-08-18", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-08-18", "url": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "BlogPosting", "abstract": "A pseudonymization gateway sits between your users and a hosted model, replaces identifying values with placeholders on the way out and restores them on the way back. It does not take you out of GDPR scope. Article 4(5) assumes the additional information still exists, and the EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data attributable through that information is personal even when the two are held by different people. What changed on 4 September 2025 is the recipient side: in Case C-413/23 P the Court of Justice held that pseudonymised data must not be regarded as personal data in all cases and for every person, while confirming that the controller's information duty is assessed at collection and from the controller's own point of view. So the gateway can move the model provider out of scope, not you, and only on the facts. The EDPB test for that sits in paragraphs 63 to 68: the additional information must be unreachable for authorities in the recipient country, held exclusively by the exporter or a trusted EEA entity, and the prompt must not let anyone single out a person. The third condition is where the category breaks, because ETH Zurich research shows models infer location, income and sex from ordinary text at up to 85 percent top-1 accuracy. Buy the gateway for one enforcement point on model choice, retention and logging, test it on 200 of your worst prompts, write the mapping-store architecture down on one page, and route prompts that cannot be de-identified to an EU-hosted or self-hosted model instead. Sources reviewed 18 August 2026.", "articleBody": " Blog overview/Business and regulation/AI governance and regulation LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope? TL;DR A pseudonymization gateway sits between your users and a hosted model, replaces identifying values with placeholders on the way out and restores them on the way back. It does not take you out of GDPR scope. Article 4(5) assumes the additional information still exists, and the EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data attributable through that information is personal even when the two are held by different people. What changed on 4 September 2025 is the recipient side: in Case C-413/23 P the Court of Justice held that pseudonymised data must not be regarded as personal data in all cases and for every person, while confirming that the controller's information duty is assessed at collection and from the controller's own point of view. So the gateway can move the model provider out of scope, not you, and only on the facts. The EDPB test for that sits in paragraphs 63 to 68: the additional information must be unreachable for authorities in the recipient country, held exclusively by the exporter or a trusted EEA entity, and the prompt must not let anyone single out a person. The third condition is where the category breaks, because ETH Zurich research shows models infer location, income and sex from ordinary text at up to 85 percent top-1 accuracy. Buy the gateway for one enforcement point on model choice, retention and logging, test it on 200 of your worst prompts, write the mapping-store architecture down on one page, and route prompts that cannot be de-identified to an EU-hosted or self-hosted model instead. Sources reviewed 18 August 2026. A pseudonymization gateway does not take you out of GDPR scope. At best it takes the model provider out of scope, and that is a narrower claim you have to be able to prove. The category sells one implicit promise: route the prompt through a pseudonymizer, and sending it to a hosted model stops being a data protection problem. Since 4 September 2025 that promise has a precise legal shape, and the shape is more useful than the marketing, because it tells you exactly which evidence a buyer has to collect. On that date the Court of Justice held, in Case C-413/23 P, EDPS v SRB, that \"pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data\". Read the second half of that sentence carefully. The data can remain personal for you while ceasing to be personal for the recipient. Your obligations do not move. The recipient's status might, if the facts support it. This page owns the buy-side question: what a bought pseudonymization platform changes about your legal position, and what evidence you need before you rely on it. Our PII redaction pipeline guide owns how to build the detection and placeholder layer with Presidio, Privacy Filter or managed DLP. Our EU data residency guide owns where the model itself runs, and our GDPR and AI Act stacking guide owns the artifact list a DACH product team has to ship. Sources reviewed on 18 August 2026. What is a pseudonymization gateway for LLMs? It is a control point that sits between your users and one or more hosted models, replaces identifying values with placeholders on the way out, and restores them on the way back. The mechanism is three steps, and every product in the category implements the same three. Detect and replace. Names, addresses, customer numbers, account identifiers and free-text mentions are found and swapped for typed placeholders. Call the model. The placeholder-bearing prompt goes to the provider. The provider never sees the original values, only the tokens. Restore. The response comes back, placeholders are mapped to the original values, and the user sees a complete answer. Products differ in packaging, not in mechanism. Some sell it as an API you put in front of your own application. Some sell a finished chat product with the gateway inside. Pryvet, a German platform in this category, is a useful worked example because it publishes enough detail to inspect. Its published pricing page starts at 29 euros per user per month with contingents from ten employees, and it groups the selectable models by server location into German, European and US-American, with GPT-5.2, Gemini 2.5 Pro, Claude Opus 4.7 and Alibaba Qwen in the third group. Its trust center lists the subprocessors behind that, including T-Systems, Microsoft Azure, AWS, MongoDB Atlas and Auth0 on the infrastructure side and Anthropic, OpenAI, Google, Mistral, DeepSeek and Alibaba Qwen on the model side. That model grouping is the most honest thing on any vendor page in this category, and it is the reason the legal analysis below matters. The gateway is the control. The destination is still a choice you make per request, and a US-hosted destination is still a Chapter V transfer of whatever actually leaves your building. Independence", "articleSection": "Business & Legal", "author": { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/" }, "citation": [ { "@type": "WebPage", "name": "Case C-413/23 P, EDPS v SRB", "url": "https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250107en.pdf" }, { "@type": "WebPage", "name": "Pryvet", "url": "https://www.pryvet.ai/" }, { "@type": "WebPage", "name": "published pricing page", "url": "https://www.pryvet.ai/tarife/" }, { "@type": "WebPage", "name": "trust center", "url": "https://www.pryvet.ai/trust-center/" }, { "@type": "WebPage", "name": "EDPB Guidelines 01/2025 on Pseudonymisation", "url": "https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf" }, { "@type": "WebPage", "name": "Beyond Memorization: Violating Privacy Via Inference with Large Language Models", "url": "https://arxiv.org/abs/2310.07298" } ], "dateModified": "2026-08-18", "datePublished": "2026-08-18", "description": "A pseudonymization gateway sits between your users and a hosted model, replaces identifying values with placeholders on the way out and restores them on the way back. It does not take you out of GDPR scope. Article 4(5) assumes the additional information still exists, and the EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data attributable through that information is personal even when the two are held by different people. What changed on 4 September 2025 is the recipient side: in Case C-413/23 P the Court of Justice held that pseudonymised data must not be regarded as personal data in all cases and for every person, while confirming that the controller's information duty is assessed at collection and from the controller's own point of view. So the gateway can move the model provider out of scope, not you, and only on the facts. The EDPB test for that sits in paragraphs 63 to 68: the additional information must be unreachable for authorities in the recipient country, held exclusively by the exporter or a trusted EEA entity, and the prompt must not let anyone single out a person. The third condition is where the category breaks, because ETH Zurich research shows models infer location, income and sex from ordinary text at up to 85 percent top-1 accuracy. Buy the gateway for one enforcement point on model choice, retention and logging, test it on 200 of your worst prompts, write the mapping-store architecture down on one page, and route prompts that cannot be de-identified to an EU-hosted or self-hosted model instead. Sources reviewed 18 August 2026.", "headline": "LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?", "image": "https://wavect.io/img/blog/headers/header_llm-pseudonymization-gateway-gdpr-2026.svg", "inLanguage": "en", "keywords": "Pseudonymization, GDPR", "mainEntityOfPage": { "@id": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/", "@type": "WebPage" }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/", "wordCount": 4207 } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/blog/overview/", "name": "Blog overview", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/blog/topics/business-regulation/", "name": "Business and regulation", "position": 3 }, { "@type": "ListItem", "item": "https://wavect.io/blog/clusters/ai-governance/", "name": "AI governance and regulation", "position": 4 }, { "@type": "ListItem", "item": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/", "name": "LLM Pseudonymization Gateway and GDPR Scope | ", "position": 5 } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "For the party that holds or can reach the additional information, yes. The EDPB Guidelines 01/2025 on Pseudonymisation state at paragraph 22 that pseudonymised data which could be attributed to a natural person by use of additional information is personal, and that this holds even when the data and the additional information are not in the hands of the same person. Since the CJEU judgment of 4 September 2025 in C-413/23 P, the same data may nonetheless not be personal data for a recipient who cannot realistically re-identify anyone." }, "name": "Is pseudonymized data still personal data under GDPR?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. Compliance is a property of your processing, not of a tool. The gateway can reduce what the model provider receives and can serve as a supplementary measure supporting a third-country transfer, but you remain the controller with the legal basis, information duty, DPIA, records and retention obligations. No vendor certification transfers those." }, "name": "Does a pseudonymization gateway make an LLM GDPR compliant?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. The EDPB treats pseudonymisation as a supplementary measure on top of an Article 46 transfer tool, not as a substitute for it. Paragraphs 63 to 68 of the guidelines list the conditions under which it strengthens such a transfer, including that the additional information is held exclusively by the exporter or a trusted entity in the EEA or an equivalent jurisdiction." }, "name": "Can pseudonymization replace standard contractual clauses?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "On 4 September 2025 the Court held that personal opinions are personal data because they are inherently linked to their author, that pseudonymised data must not be regarded as personal data in all cases and for every person, and that whether a data subject is identifiable must be assessed at the time of collection and from the controller's point of view for the purposes of the information duty. The Court set aside the General Court's judgment and referred the case back, so the proceedings continue." }, "name": "What did the CJEU decide in EDPS v SRB?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. Pseudonymisation keeps the additional information that allows attribution, which is what lets a gateway restore the answer. The EDPB is explicit that even erasing the mapping makes the data anonymous only if the separate conditions for anonymity are met. Marketing that uses the two words interchangeably is a signal to read the technical documentation more carefully." }, "name": "Is pseudonymization the same as anonymization?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Sometimes, and it is measurable. Typed and stable placeholders such as PERSON_1 preserve more coreference than a uniform redaction marker, but tasks that depend on real-world knowledge about the entity will degrade. Score the same task set with and without the gateway before you roll it out, because an assistant people route around provides no protection at all." }, "name": "Do placeholders reduce answer quality?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Per-seat platform pricing in this category currently starts in the region of 29 euros per user per month for entry tiers, with enterprise pricing on request. The licence is rarely the deciding number. The real comparison is licence plus the evidence work you would otherwise do yourself, against the cost of an EU-hosted model or a self-hosted deployment for the traffic that actually carries personal data." }, "name": "What should a pseudonymization gateway cost?" } ] } ```