Choosing a provider
DeepSeek: a ban in Italy and findings in South Korea
In 2025 Italy's data protection authority restricted DeepSeek's data processing with immediate effect, and South Korea's regulator found that the company had passed users' prompts to a Chinese company without their consent.
In January 2025 DeepSeek's Chinese chatbot app also drew the attention of data protection authorities. On 28 January Italy's authority, the Garante, asked the two Chinese companies behind the service for information on the possible risks to the data of millions of people in Italy.
The Garante found their answer completely insufficient: the companies said they do not operate in Italy and that European data protection law does not apply to them. The authority did not accept this. On 30 January it ordered, as an urgent measure with immediate effect, a limitation on the processing of Italian users' data, and opened an investigation.
In South Korea, at the recommendation of the Personal Information Protection Commission (PIPC), DeepSeek suspended its service from 15 February and withdrew the app from local app stores. In April the commission found that the company had transferred South Korean users' personal data to three companies in China and one in the United States, without their consent and without disclosing it in its privacy policy. Users' prompts, together with device, network and app information, went to Beijing Volcano Engine Technology, a cloud company affiliated with ByteDance. DeepSeek said it used that service to improve app security and user experience.
The commission told DeepSeek to destroy the transferred prompts immediately and to put lawful procedures in place for sending data abroad. The company undertook to report on its corrections within 60 days, and on 28 April, after publishing a Korean version of its revised privacy policy, it became available in South Korea again.
What can we learn from it?
Regulators look beyond security: they ask where the data goes, on what legal basis, and whether users were told. That is a useful guide for professional users too: the same questions help choose the right provider. Confiella reduces the risk, but pseudonymised text is still personal data under the GDPR, and the program does not take over the controller's responsibility. Before using an AI service for work, check its privacy policy for where data is processed and who receives it.
Sources
- Garante privacy: Intelligenza artificiale: il Garante privacy blocca DeepSeek
- The Korea Times: DeepSeek resumes service in Korea after disclosing revised info processing policy
- CNBC (NBC 6 South Florida): South Korea says DeepSeek transferred user data to China and the U.S. without consent
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]