DeepSeek privacy: your prompts are stored in China

In short: for personal data, the DeepSeek app or website is hard to justify at work. Data goes to China, which has neither an EU adequacy decision nor UK adequacy regulations. The Berlin data protection commissioner reported the app to Apple and Google as illegal content in June 2025; Italy’s regulator blocked the processing in January 2025.

It is worth separating the service from the model. The problems concern DeepSeek’s app, website and API, where your prompts end up on its servers. DeepSeek has also published model weights openly, for example DeepSeek-R1 under the MIT licence. If you run such a model on your own hardware, nothing is sent to DeepSeek. More on that below.

DeepSeek’s privacy policy (last updated 10 February 2026) says:

• Location: “we directly collect, process and store your Personal Data in People’s Republic of China”.
• Controller: Hangzhou DeepSeek Artificial Intelligence Co., Ltd., registered in China. According to the Berlin commissioner, it has no establishment in the EU; it has only appointed a representative under Article 27 GDPR.
• Data collected: account details, your inputs as text, voice and files, device identifiers, IP address, cookies and payment data.
• Training: inputs are also used to train and improve the models. You have the right to opt out, which the policy says you exercise by email to privacy@deepseek.com.
• Retention: “as long as necessary” for the services and legal obligations, with no fixed period.
• Transfer safeguards: the policy refers to appropriate safeguards in general terms but names no specific mechanism such as standard contractual clauses.

The Berlin commissioner explains her action by saying that Chinese authorities have far-reaching access rights to data held by Chinese companies and that DeepSeek could not show the data is protected to an equivalent standard.

The following events are documented by regulators or reputable media. Sources are listed at the end of the page.

1. 29 Jan 2025
   Open database with chat histories

   Security researchers at Wiz found a publicly accessible DeepSeek database that required no login and held over a million log lines, including chat histories, secret keys and backend details. DeepSeek secured it promptly after being told.

2. 30 Jan 2025
   Italy blocks the processing

   Italy’s Garante ordered an immediate limitation on processing Italian users’ data and opened an investigation. It found the company’s answers wholly insufficient: DeepSeek had said it did not operate in Italy and that European law did not apply to it.

3. 4 Feb 2025
   Australia bans DeepSeek on government devices

   Australia’s Department of Home Affairs directed all government entities to remove DeepSeek products from their systems and devices. Private devices are not affected.

4. 15 Feb 2025
   South Korea halts new downloads

   The data protection regulator PIPC suspended new downloads of the app. In April 2025 it found that DeepSeek had transferred South Korean users’ data to companies in China and the US without consent, including prompts to a ByteDance subsidiary. After a revised privacy policy, the app returned at the end of April.

5. 27 Jun 2025
   Berlin reports the app as illegal content

   The Berlin data protection commissioner reported the DeepSeek apps to Apple and Google under Article 16 of the Digital Services Act. She considers the transfer of user data to China unlawful because there is no equivalent protection there. A request of 6 May 2025 to withdraw the apps or make the transfers lawful had not been complied with.

6. 10 Jul 2025
   Czech warning and public sector ban

   The Czech cyber security agency NÚKIB warned against DeepSeek products, apps, web services and APIs. The government banned their use in state administration.

The Berlin report obliges Apple and Google to examine the notice. DeepSeek remains reachable in a browser regardless. For businesses, the legal position on personal data does not depend on whether an app is in a store.

• International transfer: entering personal data into DeepSeek transfers it to China. Under UK GDPR and EU GDPR that needs adequacy or appropriate safeguards. There is no adequacy for China, and the Berlin authority considers the safeguards to be missing.
• A rule for staff: make clear that the DeepSeek app and website are off limits for work data. On managed devices, the app can be blocked.
• Professional confidentiality: for client, patient and tax matters, the service is ruled out.
• EU customers: if the EU AI Act applies to you, Article 4 has required sufficient AI literacy among staff since 2 February 2025, which includes knowing where a prompt goes. More in our guide to the EU AI Act.

If you use DeepSeek privately, do not enter personal data, delete chats you no longer need and, if in doubt, delete the account and opt out of training by email.

DeepSeek-R1’s weights are publicly available under the MIT licence, along with smaller distilled versions. If such a model runs on your own computer, no prompt reaches DeepSeek. The data protection problems above concern the service, not the file.

That said, the largest model needs data centre hardware, and setting up a model by hand is not everyday office work. You would also have no link to your programs, such as dictation, Outlook or Word. A ready-made local assistant fills exactly that gap.

Germany’s data protection authorities consider technically closed systems preferable, meaning applications where data never leaves your own environment. A local assistant meets that without extra effort:

• No transfer to China, the US or anywhere else, because nothing is sent.
• No provider that stores, analyses or trains on your prompts.
• No terms that change overnight and no regulator that could block the service tomorrow.

SpeechToWork brings speech recognition and a language model to your Windows PC: dictation, writing emails, asking questions about documents, meeting minutes, transcribing audio and reading receipts. The limits are part of the picture: the model is smaller than the big cloud models, it does not search the web, it runs only on Windows, and it needs a reasonably recent PC. More in our guides to GDPR-compliant AI and local AI.

1. DeepSeek: Privacy Policy, last updated 10 February 2026
2. Wiz Research: Exposed DeepSeek Database Leaking Sensitive Information, 29 January 2025
3. Garante per la protezione dei dati personali: press release, 30 January 2025
4. Garante per la protezione dei dati personali: decision of 30 January 2025
5. CNN: Australia bans DeepSeek on government devices over security concerns, 4 February 2025
6. NBC News: South Korea suspends new downloads of DeepSeek, citing privacy concerns, 17 February 2025
7. CNBC: South Korea says DeepSeek transferred user data to China and the U.S. without consent, 24 April 2025
8. Berlin Commissioner for Data Protection and Freedom of Information: press release, 27 June 2025 (German)
9. NÚKIB (Czech Republic): warning regarding certain products of DeepSeek, 10 July 2025
10. Hugging Face: DeepSeek-R1 model card (MIT licence)
11. EUR-Lex: Regulation (EU) 2024/1689 (EU AI Act)

Last reviewed: September 2026. We checked every statement against the sources listed on 29 September 2026. Plans, settings and proceedings change often; the provider’s current documents always take precedence. This guide is not legal advice.