Private LLM or privacy proxy? What UK GDPR really asks

A private LLM is a language model you run yourself, on your own servers or in a cloud account you control, so that prompts never reach a model provider. For a UK firm handling client files it sounds like the safe default. It is also the most expensive way to solve the problem, and often not the problem you have.

Nonimo Gateway runs on your own servers. See plans and get in touch.

The UK GDPR does not ask you to own the model. It asks you to limit what personal data you use, keep it secure, and build protection in from the start. For many firms of 10 to 100 people, keeping the provider’s API and pseudonymising each request before it leaves meets that aim at a fraction of the effort.

What follows is an honest comparison: what “private” can mean, what the law and the ICO actually say, what running a model costs in hardware and people, and when each route is the right call.

What people mean by a private LLM

The phrase covers three set-ups that are often lumped together, and they carry quite different obligations.

Set-up	Where the prompt goes	Who you rely on
Open-weight model on your own hardware	Nowhere outside your building or data centre	Your own team, for everything
Model in your own cloud account	Your tenancy at a cloud provider	The cloud provider as processor, plus your team
Provider API on business terms	The model provider, under its API terms	The provider as processor, under contract

The top row is a private LLM in the strict sense. The middle row is private in the sense that matters for most contracts, since the cloud provider is a processor you already vet for email and file storage. The bottom row is not private at all, although it may still be lawful and suitable once you have a contract, a transfer mechanism and a policy on what goes into the prompt.

What UK GDPR and the ICO actually ask

There is no rule in the UK GDPR or the Data Protection Act 2018 that names self-hosting. The relevant duties are principles you meet with whatever design works.

• Minimisation. Article 5(1)(c) says personal data must be limited to what is necessary for the purpose. A model asked to summarise a lease rarely needs the tenant’s name to do it.
• Data protection by design. Article 25(1) asks for measures “such as pseudonymisation” to put principles such as minimisation into effect.
• Security. Article 32(1)(a) lists pseudonymisation and encryption among the measures appropriate to the risk.

The ICO’s guidance on security and minimisation in AI makes the same point from the other side. It mentions hosting a model on the device as one way to minimise the personal data involved in prediction, and in the same breath warns that local processing does not automatically fall outside data protection law. A private LLM changes who else sees the data. It does not change the fact that you are processing it, and your own logs, fine-tuning sets and backups are personal data like any other.

Transfers are where the UK picture is specific. OpenAI lists the United Kingdom as a data residency region for storage, but not for regional processing, as of 20 October 2026. So a request from a Manchester office is processed outside the UK, which is a restricted transfer under the ICO’s rules and needs adequacy regulations or a safeguard such as the IDTA. Pseudonymising the request does not make the transfer question go away, but what crosses the border is placeholders rather than client names, which changes the risk you are assessing.

What a private LLM costs, in hardware and people

Nobody can give you an honest figure without knowing your volumes and model, so here are the cost lines rather than invented numbers.

Hardware. Capable models need GPUs, and enough of them to cover your busiest hour rather than your average one. Add redundancy if the tool matters, and a plan for replacement as models grow.

People. Someone has to choose the model, serve it, patch the stack, watch it, and decide when to upgrade. That is a mix of infrastructure, security and machine learning skills that most firms of 50 people do not have in-house and would struggle to recruit.

Quality. The open-weight model you can afford to run may answer less well than a hosted model on the tasks your fee earners care about. You will need to test it on your own documents, and test again at every upgrade.

Your own data trail. Self-hosting moves logs, caches and evaluation sets inside your estate. That is good for control, but they still need retention periods and access controls, and a breach of your server is still a breach.

When to self-host and when a privacy proxy is enough

Self-hosting a model tends to make sense when:

• a contract, a security classification or a client instruction says the text may not leave your estate in any form, placeholders included;
• you process very high, steady volumes and are prepared to own the hardware for years;
• you need to adapt a model to your own material in ways a provider API does not allow;
• you already run an infrastructure team that can absorb a new production service.

Keeping the API and pseudonymising the request tends to be enough when:

• the task needs the meaning of the text, not the identities in it, as with drafting, summarising, classifying or extracting;
• your objection to the provider is about who sees client details, not about the provider seeing any text at all;
• you want the provider’s current models without the operational load;
• your team is small and already busy.

A worked example

Take an invented case. Severn Clinical Services, a 45-person firm in Bristol that transcribes and codes clinic letters for NHS trusts, wants a tool that suggests a summary and a coding note for each letter. The letters carry health data, so the rules in our guide on special category data in AI apply on top.

Option one is a private LLM on two GPU servers in their own rack. The board likes the sound of it until the IT manager lists what it needs: a person to run it, a test set of real letters to judge quality, and a plan for when the model is upgraded.

Option two keeps a hosted model. A proxy inside their network turns “Mrs Eileen Hartley, DOB 03/07/1951, seen by Dr Rahman at Southmead on 9 October” into “PERSON_1, DOB DATE_1, seen by PERSON_2 at LOCATION_1 on DATE_2”. The model writes its summary with placeholders, and the proxy restores the names before the coder sees it. The provider never holds the patient’s identity, the firm keeps the key, and the decision about the lawful basis and the trusts’ contracts stays where it was. Before choosing, they also check the trusts’ contracts: if a trust forbids any text leaving the estate, option one is the answer for that trust’s letters.

Neither option removes the need for a DPIA. The proxy route simply gives that assessment a narrower set of risks to describe. If your staff are using ChatGPT directly rather than through an internal tool, the practical steps for clinical text are in can NHS staff use ChatGPT.

Nonimo Gateway, the proxy route

Nonimo Gateway is a private proxy for the second option. It runs on your own servers or in your own cloud, and the content does not pass through Nonimo. It speaks the OpenAI API, so you change base_url and keep your code and your own OpenAI key. It replaces personal data before the request leaves, restores the real values in the answer, and comes as a plugin for LiteLLM.

Plans and prices are on the Nonimo Gateway page. It helps you pseudonymise; it does not replace your DPIA or your contracts.

The short answer

You do not need a private LLM to use AI on client data in the UK. You need to know what leaves your network, who receives it, and for how long it is kept. If the honest answer has to be “nothing leaves”, self-host and budget for the team. If the answer can be “placeholders leave, the names stay”, a privacy proxy will usually do the job, ideally behind the AI gateway that already holds your keys. For how data slips out of internal apps to begin with, read how a ChatGPT data leak happens from business apps, and for tools that clean text without a proxy, our overview of PII redaction software and the Presidio alternative page.

See Nonimo Gateway’s plans and get in touch.

Sources

Checked 20 October 2026.

• UK GDPR, Article 5, legislation.gov.uk. Data minimisation, Article 5(1)(c).
• UK GDPR, Article 25, legislation.gov.uk. Data protection by design, with pseudonymisation named as a measure.
• UK GDPR, Article 32, legislation.gov.uk. Pseudonymisation and encryption among the security measures in Article 32(1)(a).
• ICO, How should we assess security and data minimisation in AI?. Hosting a model on the device as a minimisation technique, and the warning that local processing does not automatically fall outside data protection law.
• ICO, A brief guide to international transfers, updated 15 January 2026. Restricted transfers and the IDTA.
• ICO, Pseudonymisation. Pseudonymised data remains personal data for whoever holds the additional information.
• OpenAI, Data controls in the OpenAI platform. The United Kingdom listed for data residency storage, with regional processing not offered there.

---

This page is for information and is not legal advice. Product details of other vendors were checked on their official pages on 20 October 2026 and can change.