Zing Forum

Reading

Using Large Language Models to Identify GDPR Key Tasks in Business Processes

This is a master's thesis study that explores how to use large language models to automatically identify key tasks related to GDPR compliance in business processes, providing new ideas for the automation of data protection compliance.

GDPR合规科技大语言模型业务流程数据保护RegTech法律信息学
Published 2026-06-03 16:44Recent activity 2026-06-03 16:54Estimated read 6 min
Using Large Language Models to Identify GDPR Key Tasks in Business Processes
1

Section 01

Introduction / Main Floor: Using Large Language Models to Identify GDPR Key Tasks in Business Processes

This is a master's thesis study that explores how to use large language models to automatically identify key tasks related to GDPR compliance in business processes, providing new ideas for the automation of data protection compliance.

2

Section 02

Original Author and Source


3

Section 03

Research Background and Problem Statement

Since the General Data Protection Regulation (GDPR) came into effect in 2018, it has imposed strict requirements on how enterprises handle personal data. However, many organizations face a core challenge in practice: how to systematically identify which links in their business processes involve GDPR compliance obligations. Traditional methods rely on manual audits, which are both time-consuming and prone to omissions. This study explores the use of large language models (LLMs) to automate this process, representing an innovative application of AI in the field of regulatory technology (RegTech).

4

Section 04

Extensiveness of Data Processing

The business processes of modern enterprises often involve a large number of data processing activities, from customer registration and order processing to after-sales service—almost every link may involve personal data. Manually sorting through these processes is not only labor-intensive but also requires professional knowledge to determine which activities fall within the scope of GDPR regulation.

5

Section 05

Complexity of Compliance Requirements

GDPR includes numerous clauses covering multiple dimensions such as the legal basis for data processing, data subject rights, the principle of data minimization, and storage period restrictions. Accurately identifying which business process links touch on these requirements requires dual professional knowledge in law and technology.

6

Section 06

Continuously Changing Business Environment

Business processes are not static; they evolve continuously with business development. Manually maintaining compliance lists is difficult to keep up with this pace of change, which can easily lead to compliance blind spots.

7

Section 07

Advantages of LLMs in Text Understanding

Large language models, through pre-training on massive amounts of text, have strong semantic understanding capabilities. They can:

  1. Understand natural language texts describing business processes
  2. Identify personal data processing activities involved
  3. Determine whether these activities comply with various GDPR requirements
  4. Output structured compliance analysis results
8

Section 08

Research Framework Design

The study may adopt the following technical path:

Data Preparation Phase

Collect and organize business process documents, including flowcharts, operation manuals, system descriptions, etc. These documents form the input for LLM analysis.

Prompt Engineering

Design specialized prompt templates to guide LLMs in identifying GDPR-related tasks. Prompts may include:

  • Explanations of key GDPR clauses
  • Examples of personal data types to focus on
  • Specification requirements for output formats

Model Evaluation and Validation

Compare the identification results of LLMs with manual expert annotations, and calculate metrics such as accuracy and recall. Cross-validation may be used to ensure the reliability of the results.