Local LLM and compliance in the public sector

The public sector falls under the GDPR and SecNumCloud framework. Serving a model on the client premises moves the question of data transfer.

Short answer. A model served on the client premises processes data in place. No data leaves the information system, which answers the GDPR and SecNumCloud framework without depending on a transfer to a third party.

Which framework applies?

The sector falls under GDPR and SecNumCloud. The sensitive point is public procurement and sovereignty. Processing carried out on site removes the transfer of data to a provider, and with it the question of hosting location and of the sub-processor.

Which platforms qualify?

Sizing depends on the model chosen. See the sizing pages for the footprint of each model on each platform.

A production illustration: gironde.qdna.fr, a citizen public-data site designed, deployed and operated by QDNA — 861 generated pages, 28 public sources, updated continuously (case study).

What this page does not say

This page describes an architecture. It is not legal advice. Compliance is assessed on the actual processing, with the organisation’s data protection officer and, where applicable, its supervisory authority.

Official sources

Does a local LLM answer GDPR and SecNumCloud?

A model served on the client premises processes data in place. No data leaves the information system, which answers the GDPR and SecNumCloud framework without depending on a transfer to a third party.

Which platform should I start with?

The choice depends on the target model and the number of users. The sizing pages give the memory footprint of each model on each platform.

Method

Parameter counts and memory figures come from the site fact sheets. Memory footprints are calculated, not measured: a reading on real hardware may differ depending on the engine and the exact weight format. Prices are indicative and not contractual.