Data protection at DeepSeek: It seems to lack "pretty much everything"
DeepSeek isn't just causing a stir among its AI competitors. German data protection experts wonder how the provider from China is complying with the GDPR.

(Image: peterschreiber.media/Shutterstock.com)
German data protection experts want to scrutinize the Chinese AI chatbot DeepSeek, according to a report by the specialist service Tagesspiegel Background. “DeepSeek seems to lack just about everything in terms of data protection law,” said Dieter Kugelmann, data protection officer for Rhineland-Palatinate, according to the report. For example, DeepSeek's chatbot is allowed extensive access by its privacy policy – including IP addresses, chat histories, uploaded files and even the pattern and rhythm of keystrokes.
According to the report, data protection officer Kugelmann also stated that he is not yet aware of any European branch or responsible legal representative of DeepSeek. This alone would be a violation of the General Data Protection Regulation (GDPR). A data protection agreement between the EU and China that provides a legal basis for data exchange does not yet exist.
DeepSeek was also discussed at the interim conference of data protection authorities in Berlin, writes Tagesschau. According to the report, Rhineland-Palatinate and several other German data protection authorities wanted to discuss further steps together. A questionnaire on data processing will probably be sent to the company first. According to the report, Italy's data protection authorities have already approached DeepSeek with questions about the handling of user data. The app is currently no longer available there.
Database open on the internet
A recent leak also shows that DeepSeek's data protection and security could be in trouble: a database of the provider with sensitive information was openly available online, as IT security researchers from Wiz discovered. “Within minutes, we found a publicly accessible ClickHouse database with a connection to DeepSeek – completely open and without authentication, granting access to sensitive data,” explained the security experts. The database contained a significant volume of chat histories, backend data and sensitive information, including log streams and API secrets.
DeepSeek had caused a sensation with its AI chatbot, which can compete with the large OpenAI models despite requiring significantly less training and even performs better in some cases. This also caused a veritable stock market upheaval, with tech stocks such as graphics card manufacturer Nvidia falling significantly. According to reports, major OpenAI investor Microsoft wants to investigate whether DeepSeek has accessed OpenAI data in an unauthorized manner; a crisis team has already been set up at Meta regarding DeepSeek. Some observers are talking about a Sputnik moment.
(axk)