DeepSeek hit with an urgent processing-limitation order after arguing EU law did not apply to it
Subject: Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence
What happened
The DeepSeek chatbot was downloaded by millions within days of launch. On 28 January 2025 the Italian Garante sent an information request to the two Chinese companies, flagging a possible risk to the data of millions of people in Italy.
How it was handled
The companies replied that they do not operate in Italy and that European legislation does not apply to them. The authority deemed the content of that reply entirely unsatisfactory and contrary to its own findings.
Outcome
On 30 January 2025 the authority ordered, as a matter of urgency and with immediate effect, a limitation on the processing of Italian users’ data by both companies, and opened a formal investigation at the same time.
What it means for Chinese exporters
- · "We have no local entity" is not an exemption. Art. 3(2) GDPR turns on whether you offer services to, or monitor the behaviour of, people in the EU; a downloadable app in the local store, a local-language interface, or pricing in local currency will each be cited as evidence of offering services.
- · Your reply to a regulator’s first information request is itself enforcement evidence. The first response should be finalised by local counsel fluent in the GDPR and answer the factual questions point by point, rather than leading with a jurisdictional objection — here the jurisdictional argument was judged entirely unsatisfactory and the matter escalated to a limitation order within two days.
- · Before launching a consumer AI app in the EU, complete three things: the Art. 27 EU representative appointment, a privacy policy in the relevant EU languages, and a working channel for data subject requests. Missing any one of them makes an urgent-procedure finding of uncontrolled risk close to inevitable.
- · Urgent limitation orders land in days, not months. Tie the overseas launch cadence to compliance readiness: do not run large download-growth campaigns before the compliance pack is complete, or the sunk cost of a stop order will be at its maximum.
Related regulations
Sources (1)
- Italian Garante orders urgent limitation on processing against DeepSeekItalian Data Protection Authority (Garante per la protezione dei dati personali) · published 2025-01-30 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.