Ethics & data

GDPR and Text Data: Personal Data in NLP Corpora and Models

Ethics & data · Published 2026-10-26

A rusty metal hasp and padlock fastening a weathered red wooden door
A padlock on the door of an old storehouse in Oulu, Finland. Photo: Estormiz, CC0.

Text is full of people. Emails, chat logs, medical notes, court decisions, social media posts and even news articles contain names, addresses, opinions and health details. When such text is collected for natural language processing in Europe, or concerns people in Europe, the General Data Protection Regulation (GDPR) applies. This guide explains how.

This article explains the general framework; it is not legal advice. Research projects should consult their institution's data protection officer, and national laws add specific rules for research.

What counts as personal data in text

The GDPR (Regulation (EU) 2016/679), applicable since 25 May 2018, defines personal data in Article 4(1) as any information relating to an identified or identifiable natural person. In text this includes obvious identifiers such as names, email addresses, phone numbers and ID numbers, but also combinations of details that point to one person: "the only female surgeon at the hospital in this small town" identifies someone without naming her. Recital 26 explains that identifiability depends on all the means "reasonably likely to be used", taking into account cost, time and available technology.

Some data receives extra protection. Article 9 lists special categories, including racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life and sexual orientation, genetic and biometric data. Free text reveals these constantly: a forum post about a diagnosis or a tweet about a demonstration is special-category data about its author.

Lawful bases and the research provisions

Processing needs one of the lawful bases in Article 6: consent, a contract, a legal obligation, vital interests, a task carried out in the public interest, or legitimate interests balanced against the rights of the people concerned. Universities often rely on the public-interest task; companies often invoke legitimate interests. Special-category data additionally needs an exception under Article 9(2), one of which covers scientific research based on EU or national law with appropriate safeguards (Article 9(2)(j)).

Several provisions ease research, always subject to the safeguards of Article 89, such as data minimisation and pseudonymisation:

These are not blanket exemptions. A project must still document its purpose, collect no more than it needs, secure the data, and usually carry out a data protection impact assessment (Article 35) when processing is large-scale or involves sensitive data.

Pseudonymisation is not anonymisation

Replacing names with codes is pseudonymisation (Article 4(5)): the data is still personal, because it can be re-linked with additional information. Anonymisation means that no one can reasonably identify the person any more. The Article 29 Working Party, predecessor of today's European Data Protection Board, explained in its Opinion 05/2014 on anonymisation techniques that this is a high bar, assessed against risks of singling out, linking records and inference.

For text, the bar is particularly hard to reach. Pierre Lison, Ildikó Pilán, David Sánchez, Montserrat Batet and Lilja Øvrelid reviewed the field in "Anonymisation Models for Text Data: State of the art, Challenges and Future Directions" (ACL 2021). They point out that NLP de-identification tools usually remove predefined categories of named entities, while re-identification often comes from indirect details (a job, a date, a rare event) that no entity tagger flags. Their conclusion: removing names is not the same as anonymising a document, and privacy risk must be assessed for the whole text.

Models can remember

Language models can reproduce parts of their training data. Nicholas Carlini and colleagues (USENIX Security 2021) extracted hundreds of verbatim sequences from GPT-2, including names, phone numbers and email addresses that appeared in its web training data. Memorisation is more likely for text repeated many times and for larger models.

In Opinion 28/2024, adopted on 17 December 2024, the European Data Protection Board addressed AI models trained on personal data. It found that such models cannot be considered anonymous in all cases: anonymity must be assessed case by case, considering whether personal data can be extracted or obtained through queries. It also set out how the legitimate-interest test applies to the development and deployment of models, and noted that unlawful processing at the training stage can affect the lawfulness of later use.

Everyday tools are processing too

The same principles apply in daily life. Pasting a document containing personal details into an online translation, summarisation or chat service sends that data to a third party, which may store it or, depending on its terms, use it to improve its systems. Organisations should check the terms and data processing agreements of such tools before staff use them with customer or employee data, and individuals should think twice before pasting a tenancy agreement into an online translator with their passport number still in it.

A checklist for NLP projects

  1. Map the personal data in your sources, including indirect identifiers and special categories.
  2. Define the purpose and lawful basis, and involve your data protection officer early.
  3. Minimise: collect only the fields and time span you need; drop metadata such as user IDs if not required.
  4. Pseudonymise at ingestion and keep the key separately, accepting that the data remains personal.
  5. Assess re-identification risk before any release; prefer controlled access to public release for sensitive corpora.
  6. Test models for memorisation of rare personal strings before publishing weights or outputs.
  7. Document these choices in your datasheet (see datasheets and model cards) and publish a privacy notice when individual notification is impossible.

Data protection is one part of the question of whose text may be used; copyright and consent of authors are another, covered in our article on web-scraped corpora. Choices about which data to remove can also affect fairness, as discussed in bias in NLP.

Sources

Read next

More in Ethics & data
A server rack packed with stacked machines, blue status displays and bundles of white network cablesEthics & data

Web-scraped corpora and consent

Common Crawl, robots.txt, the EU's text and data mining opt-out and the AI Act: the legal and ethical questions behind training data scraped from the web.

Two women programmers set up the wiring panels of the room-sized ENIAC computer in a black-and-white photographEthics & data

Bias in NLP

Stereotypes in embeddings, gendered mistranslations, dialects flagged as offensive: what research has shown about bias in language technology and what helps.

An old bound laboratory logbook lying open on a desk, its handwritten pages yellowed and stainedOpen research

Datasheets, data statements and model cards

The three documentation formats every NLP researcher should know, what each asks, and how they connect to EU transparency rules.