European Union: Council of Europe released draft guidelines on privacy and data protection in the context of large language models-based systems

On 2 September 2025, the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) of the Council of Europe released the draft guidelines on privacy and data protection in the context of large language models (LLM)-based systems (T-PD(2025)3), setting out a structured framework to identify, assess, mitigate and monitor privacy risks in accordance with Convention 108+ principles. The document provides stakeholder-specific guidance for States, governments, providers, deployers, industry, civil society, users, and supervisory authorities, mapping Convention 108+ provisions such as lawfulness, fairness, purpose limitation, minimisation, accuracy, transparency, data security, and accountability to concrete actions across the LLM lifecycle, including training, fine-tuning, deployment, and user interaction. It incorporates a risk management methodology aligned with privacy impact assessments, human rights and fundamental rights impact assessments (HUDERIA), and promotes governance mechanisms to ensure interoperability with parallel frameworks such as the General Data Protection Regulation (GDPR), the Digital Services Act (DSA) and the EU Artificial Intelligence Act (AI Act), while addressing systemic risks such as repurposing of training data, generation of synthetic data and the inference of personal data in operational contexts.