One framework, explicit local questions
This guide covers Ireland, Germany, France, the Netherlands, Spain, Italy, Sweden, Poland, and Estonia together because the core GDPR transfer framework is shared. Separate country pages repeating the same checklist would obscure the decisions that actually matter. Identify the supplier establishment, collection countries, individuals represented, and any local employment, health, confidentiality, or intellectual-property issues. Have counsel decide which supervisory authority and national rules are relevant rather than assuming the buyer’s preferred EU office settles jurisdiction.
Separate lawful processing from export
The European Data Protection Board explains that international-transfer requirements apply in addition to the GDPR’s underlying processing obligations. A transfer mechanism does not independently justify collecting a corpus or using it for a new training purpose. Map the legal entities and distinguish controller-to-controller licensing from processing on the supplier’s instructions. If another organisation outside the EEA can access personal data, assess Chapter V rather than treating European hosting as a complete answer.
Prepare a reviewable release
Organise the evidence by source and purpose, not merely by country flag. Include collection notices, rights documentation, retention decisions, and the rationale for removing or retaining fields. Give the buyer a schema and synthetic examples first. For a real evaluation sample, specify the records, recipients, duration, and permitted testing activity. Ask about model memorisation testing and how complaints or deletion requests will be investigated; avoid promising that deleting a source file automatically removes its influence from a trained model.
- Record any adequacy decision or safeguards actually applicable to the recipient.
- Flag special-category data and children’s records for separate review.
- Retain a versioned record of the authorised dataset and training purpose.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.