GDPR-compliant AI agents, Article 28 native DPA.
The model runs inside Intel TDX; our relay forwards requests in clear. EU company, EU-hosted customer database. One Article 28 DPA, a named sub-processor list, and SCCs already in place.
GDPR + EU AI Act overlap
Two regulations, one stack.
GDPR governs personal data. The EU AI Act governs AI systems. Where AI processes personal data, almost every regulated workflow, both apply at once, and the technical measures you document for Article 32 GDPR confidentiality can also serve Article 15 AI Act cybersecurity. Running the model in Intel TDX is evidence for both, for the model's host.
Art. 28 GDPR
Controller/processor agreement
Native DPA, no negotiation
Art. 32 GDPR
Confidentiality of processing
Intel TDX, memory encrypted by the CPU
Art. 35 GDPR
DPIA for high-risk processing
DPIA template + attestation evidence
Art. 44+ GDPR
Transfers documented and mitigated
SCCs + TIA; EU-hosted database, US compute and hosting
Art. 12 AI Act
Automatic event logging
Your log, with the attestation of the serving instances
Art. 26 AI Act
Deployer documentation
Model cards + attestation logs
Article 28, native DPA
One DPA. No negotiation. SCCs already signed.
VOLTAGE EI is an EU controller subject to French data protection authority (CNIL) supervision. Our Article 28 DPA covers sub-processors, security measures, breach notification timelines (72 hours), audit rights and instructions on processing, aligned with the strictest reading of GDPR. Available on request, signed before production access.
What the DPA covers
- Processor obligations (Art. 28(3) sub-clauses)
- Sub-processor list with prior authorisation
- Technical and organisational measures (Art. 32)
- Breach notification within 72 hours
- Data subject rights assistance
- Audit rights and inspection cooperation
- Return or deletion at end of processing
- Transfers to US sub-processors covered by SCCs and a transfer impact assessment
Article 32, confidentiality by hardware
Hardware isolation for the model.
Article 32(1)(b) requires confidentiality of processing as a technical measure appropriate to the risk. Running the model inside Intel TDX is one such measure: memory encryption by the CPU with keys generated at boot and an Intel TD Quote of the serving instances on request. It covers the model's host; our relay sees prompts in clear while forwarding them.
Memory encryption by the CPU
Keys generated inside the CPU for each trust domain. The enclave's RAM is opaque to the host operator and to the hypervisor.
Attestation on request
ECDSA quote bound to the enclave measurement. Independently verifiable on /trust.
EU jurisdiction
VOLTAGE EI, France, subject to CNIL. Our inference provider and hosting are US companies, listed at /legal/subprocessors.
Native DPA
Article 28 DPA on file before production access. SCCs and the transfer impact assessment come with it.
Sub-processor list
Two sub-processors. Both EU-aligned. Both in the DPA.
The customer database is EU-hosted (Frankfurt); the website and the API relay run on a US host. Changes to the sub-processor list are notified in advance with right of objection.
FAQ
GDPR + AI questions buyers ask.
Do you sign a GDPR Article 28 DPA?
Yes. We provide a native Article 28 Data Processing Agreement that does not require negotiation. VOLTAGE EI is an EU controller (France, SIREN 943 808 824) subject to CNIL. The DPA covers sub-processors, security measures, breach notification timelines and audit rights aligned with the strictest interpretation of GDPR.
Who are the sub-processors?
One confidential compute provider (Intel TDX GPU compute, US-operated, locations vary by capacity) and one TEE inference provider for model serving, both named at /legal/subprocessors and listed in the DPA. Memory is encrypted by the CPU with a key per trust domain, and the host sits outside the trust domain; the attestation is verifiable by you (see /trust for what we prove and what we do not claim). The customer database is EU-hosted (Frankfurt); the website and the API relay run on a US host, also listed at /legal/subprocessors.
How is Article 32 confidentiality satisfied?
The model runs inside Intel TDX at our inference provider: memory encrypted by the CPU with keys it holds, and attestation of the serving instances on your nonce. Our relay sees prompts in clear while forwarding them, so this is a measure for the model's host, not a claim that VoltageGPU has no access to your data.
Is Schrems II a problem here?
The customer database is EU-hosted (Frankfurt); the website, the API relay and the TEE inference provider are in the US. Confidential compute runs on a US-operated GPU provider listed in the DPA, so SCCs and a transfer impact assessment apply, and both are provided. The mitigating control is hardware: memory is encrypted by the CPU with a key per trust domain and the host operator sits outside the trust domain, so software on the host only sees encrypted memory. Physical attacks are outside that threat model, and the transfer impact assessment still applies.
Can I use this for special category data (Article 9)?
Yes, subject to a lawful basis under Article 9(2). Running the model in Intel TDX reinforces appropriate technical measures for health, biometric or judicial data, for the model's host. We provide a DPIA template aligned with Article 35 to support your assessment.
Related compliance pages
Article 12, 14, 15 and 32 obligations enforceable from 2 August 2026.
ICT third-party risk and operational resilience for financial entities.
Essential and important entities, supply chain security, incident reporting.
Sample attestation log JSON, retention and API access.
Vertical agents for legal, finance, regulated professionals, model in TDX.
Verify any request against the public attestation root.
Intel TDX trust domains with the GPU attached inside, as raw compute.
RGPD-aligned legal AI agents and procurement materials.
In-depth marketing-site guide on aligning AI with French and EU data law.
Get the DPA. Run the workflow. Walk away with attested evidence.
Article 28 DPA on signing. The model in Intel TDX for Article 32. EU company, EU-hosted customer database.