GDPR-compliant AI agents — Article 28 native DPA.
Hardware-sealed inference inside Intel TDX. Provider-blind processing. EU data residency. No SCCs to negotiate, no US sub-processors in the inference path.
GDPR + EU AI Act overlap
Two regulations, one stack.
GDPR governs personal data. The EU AI Act governs AI systems. Where AI processes personal data — almost every regulated workflow — both apply at once. The 2026 EU AI Office and EDPB joint guidance makes the overlap explicit: Article 32 GDPR confidentiality and Article 15 AI Act cybersecurity must be satisfied with the same technical measures. Hardware sealing covers both with one piece of evidence.
Art. 28 GDPR
Controller/processor agreement
Native DPA, no negotiation
Art. 32 GDPR
Confidentiality of processing
Intel TDX, AES-256 CPU-fused
Art. 35 GDPR
DPIA for high-risk processing
DPIA template + attestation evidence
Art. 44+ GDPR
No transfer outside EEA
EU regions only, French app layer
Art. 12 AI Act
Automatic event logging
Per-request ECDSA quote
Art. 26 AI Act
Deployer documentation
Model cards + attestation logs
Article 28 — native DPA
One DPA. No negotiation. No SCCs.
VOLTAGE EI is an EU controller subject to French data protection authority (CNIL) supervision. Our Article 28 DPA covers sub-processors, security measures, breach notification timelines (72 hours), audit rights and instructions on processing — aligned with the strictest reading of GDPR. Available on request, signed before production access.
What the DPA covers
- Processor obligations (Art. 28(3) sub-clauses)
- Sub-processor list with prior authorisation
- Technical and organisational measures (Art. 32)
- Breach notification within 72 hours
- Data subject rights assistance
- Audit rights and inspection cooperation
- Return or deletion at end of processing
- No international transfer outside EEA in inference path
Article 32 — confidentiality by hardware
Provider-blind by design.
Article 32(1)(b) requires confidentiality of processing as a technical measure appropriate to the risk. Hardware-sealed inference inside Intel TDX is the strictest available implementation: AES-256 memory encryption with keys fused into the CPU at boot, NVIDIA Protected PCIe between CPU and GPU, ECDSA attestation per request. VoltageGPU operators are technically incapable of reading user prompts. A French court order to dump RAM would return ciphertext.
AES-256 memory encryption
Keys fused inside the CPU at boot. RAM is opaque to operators and to the hypervisor.
Per-request attestation
ECDSA quote bound to the enclave measurement. Independently verifiable on /trust.
EU jurisdiction
VOLTAGE EI, France. Subject to CNIL. No FISA 702 exposure.
Native DPA
Article 28 DPA on file before production access. No SCCs to chase.
Sub-processor list
Two sub-processors. Both EU-aligned. Both in the DPA.
No US hyperscaler in the inference path. Application layer (auth, billing) hosted in France. Changes to the sub-processor list are notified in advance with right of objection.
FAQ
GDPR + AI questions buyers ask.
Do you sign a GDPR Article 28 DPA?
Yes. We provide a native Article 28 Data Processing Agreement that does not require negotiation. VOLTAGE EI is an EU controller (France, SIREN 943 808 824) subject to CNIL. The DPA covers sub-processors, security measures, breach notification timelines and audit rights aligned with the strictest interpretation of GDPR.
Who are the sub-processors?
Targon (Intel TDX confidential GPU compute, EU regions) for compute and Chutes (TEE inference endpoints) for model serving. Both are listed in the DPA. No US hyperscalers in the inference path. EU data residency in France for the application layer.
How is Article 32 confidentiality satisfied?
Hardware-sealed processing inside Intel TDX. AES-256 memory encryption with keys fused into the CPU, NVIDIA Protected PCIe between CPU and GPU, per-request ECDSA attestation. VoltageGPU operators are technically incapable of reading user prompts — this is the strictest defensible reading of Article 32(1)(b).
Is Schrems II a problem here?
No. Personal data does not leave the EEA in the inference path. There is no transfer to a third country requiring SCCs or transfer impact assessment. The application layer hosts in France; compute runs in EU regions on TDX-attested hardware.
Can I use this for special category data (Article 9)?
Yes, subject to a lawful basis under Article 9(2). Hardware sealing reinforces appropriate technical measures for health, biometric or judicial data. We provide a DPIA template aligned with Article 35 to support your assessment.
Related compliance pages
Article 12, 14, 15 and 32 obligations enforceable from 2 August 2026.
ICT third-party risk and operational resilience for financial entities.
Essential and important entities, supply chain security, incident reporting.
Sample attestation log JSON, retention and API access.
Vertical agents for legal, finance, regulated professionals — sealed in TDX.
Verify any request against the public attestation root.
Intel TDX, Protected PCIe, attested GPUs as raw compute.
RGPD-aligned legal AI agents and procurement materials.
In-depth marketing-site guide on aligning AI with French and EU data law.
Get the DPA. Run the workflow. Walk away with attested evidence.
Article 28 DPA on signing. Article 32 confidentiality by hardware. EU data residency by design.