A common misunderstanding: "But I have a DPA"
A data processing agreement (DPA under Art. 28 GDPR) covers data protection. Professional secrecy is a second, separate issue:
| DPA (GDPR) | Confidentiality undertaking (e.g. § 203 StGB, § 43e BRAO) | |
|---|---|---|
| Protects | Personal data | Everything entrusted to you in your professional role – including business secrets with no personal data |
| Who is liable | Controller and processor (fines, damages) | You personally (in Germany under criminal law, plus professional law) |
| Typical content | Instructions, technical and organisational measures, sub-processors, third countries | Duty of confidentiality, notice of the criminal consequences, access only where necessary, passing the duty on to subcontractors |
| At large AI providers | Usually standard, available online | Rarely public, often only on request or via cloud platforms |
In short: a DPA, yes – but without a confidentiality undertaking, in Germany you're only halfway there.
Who is affected – and what applies where?
Simplified overview. Parts of the legal position have not been settled by the courts, and professional chambers take lines of differing strictness.
🇩🇪 Germany
- § 203 StGB (Criminal Code): doctors, lawyers, notaries, tax advisers, auditors and other professions may involve service providers ("contributing persons") – where necessary and only if they have bound them to confidentiality (§ 203(3) and (4)).
- § 43e BRAO, § 62a StBerG, § 26a BNotO: contract in text form, notice of the criminal consequences, access only where needed, subcontractors bound as well. Providers abroad only with comparable protection of secrets. Services that directly serve a single mandate additionally require the client's consent (lawyers and tax advisers; notaries: consent for the individual official act).
- The German Federal Bar's guidance (BRAK, 12/2024) is strict: as of then, transferring client secrets to language models was generally not necessary. More generous views also exist in the professional debate. Our recommendation: plan conservatively.
🇦🇹 Austria
- Lawyers (§ 9 RAO) and notaries (§ 37 NO): confidentiality also covers assistants – you have to bind and supervise them. Whether and how far external IT and AI providers are covered must be assessed case by case. To be safe, plan as if they were.
- Under criminal law (§ 121 StGB), mainly health professions and insurers are covered – not lawyers and notaries. For them, consequences come through disciplinary, civil and data protection law.
🇱🇮 Liechtenstein
- § 121 StGB covers lawyers, notaries, trustees, auditors, patent attorneys and health professions, among others – assistants are treated the same. Prosecution at the request of the injured person.
- Plus professional rules (e.g. Art. 15 of the Lawyers Act, RAG) and, as an EEA state, the GDPR.
🇨🇭 Switzerland
- Art. 321 StGB: lawyers, notaries, doctors, auditors and other professions as well as their assistants – a cloud or AI provider can be an assistant. What's expected: careful selection, contractual confidentiality and supervision.
- Data protection: revFADP/nDSG (processing on behalf Art. 9, disclosure abroad Art. 16).
For everyone: if personal data goes to the US, you need a transfer mechanism under the GDPR or the FADP (e.g. the Data Privacy Framework or standard contractual clauses). That's data protection – professional secrecy comes on top.
Self-check – 6 questions, 3 minutes
The check runs only in your browser. Nothing is stored and nothing is sent.
The three results
- 🟢 You're fine. You only use AI without confidential information, or all six boxes are ticked and ZDR is confirmed. Tip: keep the documents in an "AI compliance" folder and review it once a year – providers change their terms all the time.
- 🟡 Action needed. You use a business or API account, but at least one document is missing (usually the confidentiality undertaking or the subcontractor chain), or ZDR is unclear. This can usually be fixed: choose the right access route, request an addendum, document your settings.
- 🔴 Stop & talk to us. Confidential information ends up in a consumer app, with a provider without a DPA, or in a third country without protection (e.g. hosted services storing data in China). Stop until this is resolved and get support – for dealing with what already happened, start with your chamber or your legal adviser.
How the scoring works
- Question 1 "Not bound by professional secrecy": data protection is usually enough – check the DPA and third-country transfers. More: Which data must never go in the chat.
- Question 2 "Only general material": 🟢 You're fine. Still set rules for account data, metadata and accidental uploads.
- Question 3 "Consumer version or private account": 🔴. For self-hosting, go straight to question 6.
- Question 4 "No, or I don't know": 🟡 Talk to us. The default is usually storage for up to 30 days for abuse monitoring.
- Question 5 "Partly, or by hand": 🟡 at best. "No": the contract (question 6) becomes mandatory.
- Question 6: if the DPA is missing, the result is 🔴. If any other box is missing, it's 🟡. 🟢 requires all six boxes and confirmed ZDR (or self-hosting).
Let's go through your answers together: Book an initial call.
Which provider offers what?
As of: 3 November 2026. A snapshot from the providers' public documents. Terms change often – check the current version before you sign.
| Provider / route | ZDR | DPA | EU hosting | Training on your data | § 203 addendum | Note |
|---|---|---|---|---|---|---|
| Anthropic (Claude API direct) | On request, not for all features | Please have the provider confirm | No (global/US) | No (commercial) | Not publicly documented, please ask the provider | EU region via AWS or Google Cloud |
| OpenAI (API / Enterprise) | After approval | Yes | Yes (EU data residency, with conditions) | No (business default) | Not publicly documented, please ask the provider | Alternative: Azure |
| xAI (Grok API) | Yes, can be enabled for the team | Yes – requires ZDR for personal data | Not publicly documented | No (without permission) | Not publicly documented, please ask the provider | Transfer to the US |
| Cursor (coding) | Yes, via Privacy Mode | Please ask the provider | Not publicly documented | No (Privacy Mode) | Not found publicly | For code, not for case files |
| DeepSeek (hosted) | No | Not found | No – stored in China | Yes (opt-out) | No | Unsuitable for professional secrets |
| Mistral (API) | On request, stateless endpoints only | Yes (online) | Yes (EU by default) | Opt-out available; confirm the default with the provider | Not publicly documented, please ask the provider | Models can also be self-hosted |
| Google Cloud (Vertex AI) | Achievable with configuration | Yes | Yes (regional endpoint) | No | Yes – Professional Secrecy Addendum (Germany), on request from the provider | Check web search (grounding), caching and logging |
| Self-hosted (e.g. Hetzner plus an open-weight model) | You control it | Yes (with the host) | Yes | No | Settle with the host | Operations are on you |
Remember: "no training" doesn't mean "no storage". And "EU hosting" doesn't mean "professional secrecy sorted".
Good to know: some providers offer a § 203 addendum only on request – and sometimes only to legal entities, not to sole proprietors. If you work alone or as a sole proprietorship, clarify this before you sign.
And what about the "harness"?
A harness is the software layer around a model: agent, tools, file access. Example: the open-source app "DeepSeek Harness" sends session data to DeepSeek servers in China in its default mode. With your own model endpoint, its privacy notice says it does not store inputs and outputs on its servers. You should still check account and telemetry data before using it in your firm.
So what always counts for protection is: where does the data end up? How to secure AI agents in your organisation – inventory, permissions, approvals, logging – is covered in our Security Harness.
Option 1 – Self-host (e.g. at Hetzner)
If you don't want to involve a US provider, you can run an open model (e.g. from Mistral, Meta, Qwen or DeepSeek – as a download, not as a cloud service) on your own GPU server. The model maker then sees nothing; your service provider is the host.
Example servers at Hetzner (list prices on hetzner.com, as of 3 November 2026, excl. VAT):
| Server | GPU memory | Location | Per month | Setup | Roughly suited for* |
|---|---|---|---|---|---|
| GEX45 | 24 GB | Helsinki (FI) | €214 | €209 | Smaller models, one person or a small team |
| GEX63 | 96 GB | Helsinki (FI) | €999 | €999 | 70-billion-parameter class models (quantised) |
| GEX131 | 96 GB, more RAM | Helsinki (FI) / Falkenstein (DE) | from €1,499 | €1,499 | Like GEX63, more headroom |
| GEX430 | 4 × 96 GB | Helsinki (FI) | €3,599 | €3,599 | Large open models, several teams |
* Rule of thumb, not a performance promise. Test with your own documents before you decide. Contract terms and other conditions are listed in Hetzner's offer.
The good: EU location, no training, free choice of model, predictable costs.
The honest part: you (or we) run the server – updates, access control, backups, logs. Open models are weaker than the large cloud models at some tasks. And with the host, too, you need a DPA and a confidentiality arrangement.
How a shared AI workspace for your team can look: Own Your Intelligence.
Option 2 – Anonymise before it leaves
Replace names, addresses, IBANs and case references with placeholders automatically – only then send it to the model. Possible building blocks:
- Presidio (open source, originally from Microsoft, now at github.com/data-privacy-stack/presidio): detects and replaces personal data. For German you need German language models for name recognition and your own recognition rules, e.g. for Swiss AHV numbers or case references.
- Google Sensitive Data Protection: de-identification via API for your live prompts. With Discovery for Vertex AI, you can also scan training and tuning data in Google Cloud for sensitive content. Note: Discovery only checks stored datasets, not your prompts.
The limit: anonymisation replaces names, not the facts. "The dental practice in the village with the ongoing tax case" stays recognisable. Pseudonymised data is still personal data (GDPR). Anonymisation lowers the risk – it only replaces the contract if truly no one can be identified any more. What never belongs in an AI chat: Which data must never go in the chat.
How digihub helps you
digihub.li Genossenschaft supports you in four steps:
- Inventory: which tools does your team really use – including the ones you don't know about?
- Choose the access route: provider API, EU cloud platform or self-hosted – matched to data type, budget and country.
- Document check: DPA, confidentiality undertaking, subcontractors, third countries, consent – what's missing and what you need to request. You do the legal sign-off with your chamber or legal adviser; we prepare it.
- Technology: set up ZDR correctly, add anonymisation up front, secure agents (Security Harness), and local models with Ollama if you want them (Local AI on your own hardware).
Do you need a § 203 agreement? We help.
You don't need one? Are you sure? Let's check whether you've done your homework. In person and without obligation, at our office in Schaan or online.
Sources
- Germany: § 203 StGB, § 43e BRAO, BRAK guidance on AI use (PDF, German)
- Liechtenstein: Criminal Code, Lawyers Act
- Switzerland: Criminal Code (Art. 321), Data Protection Act
- Providers: Anthropic, OpenAI, xAI, Cursor, DeepSeek, Mistral, Google Vertex AI