Overall risk · high
compliancecritical
Italy's Garante maintains a definitive ban on DeepSeek processing Italian users' personal data, first imposed in January 2025, citing GDPR non-compliance across multiple articles.
jurisdictionhigh
DeepSeek's hosted consumer/API service processes and stores personal data in China, subject to PRC state-access laws, which multiple EU regulators have found unlawful under GDPR Article 44/46.
compliancehigh
Germany's Berlin data protection commissioner referred DeepSeek to Apple and Google under DSA Article 16 for unlawful China data transfers; the Netherlands has banned DeepSeek on government devices.
securityhigh
A January 2025 disclosure found an unauthenticated, internet-exposed ClickHouse database leaking over a million lines of plaintext chat logs and API keys.
governancemedium
No EU legal entity, GDPR Article 27 representative, or public Article 28 Data Processing Agreement has been identified for DeepSeek's hosted services, complicating enforcement and contractual redress for EU customers.
governancemedium
DeepSeek's first external funding round (mid-2026) includes a Chinese state investment fund among its investors, deepening formal state financial ties beyond its existing High-Flyer relationship, alongside a planned mainland China IPO.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.