The Personal Data Protection Office recommends caution when using DeepSeek

The Personal Data Protection Office analyses the information related to the DeepSeek R1 model and looks at the service offered by the Chinese provider in terms of whether it meets the data processing requirements applicable in the EU. For the Personal Data Protection Office, it is important whether the application of Chinese companies providing the DeepSeek chatbot operates in accordance with the principles of data processing, whether the providers are wary of the scope and purposes of processing and whether they comply with the information obligation towards their users.

DeepSeek is a chatbot based on generative artificial intelligence technology, which in January 2025 was introduced to the global market, among others as a free application. DeepSeek's core component is software designed to understand and process human conversations. The service is provided by Chinese-registered companies Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and Beijing DeepSeek Artificial Intelligence Co. In just the first two weeks, 3.6 million people worldwide downloaded the software.

Taking into account the preliminary findings related to the information shared by the provider in its privacy policy, the President of the Personal Data Protection Office recommends extreme caution in the use of applications and other services offered within DeepSeek. The information contained therein shows, inter alia, that user data may be stored on servers located in China. It should be recalled that China is not one of the countries for which an adequacy decision has been issued by the European Commission and, under the current legislation, the Chinese government has extensive powers regarding access to personal data without the guarantee of protection provided under the European data protection laws.

The Personal Data Protection Office also recalls that technologies based on generative artificial intelligence are designed to process a huge amount of data that can be used for purposes that are incompatible with the user's original wish, e.g. to further train the model or for marketing purposes.

The Personal Data Protection Office is in contact with the other supervisory authorities -members of the European Data Protection Board - to research DeepSeek's activities in the EU and their impact on the protection of individuals with regard to the processing of their data. The Personal Data Protection Office exchanges information on national activities with the other supervisory authorities.