European ChatGPT alternative: privacy and GDPR-compliant work

As long as you use AI to come up with a recipe, privacy is an abstract topic. As soon as a customer name, a case number or a payslip is in your prompt, it becomes a concrete question: where is this text processed, who can access it, and how long does it stay there.

For Dutch users that is not a theoretical issue. The GDPR (AVG in Dutch) requires you to know where personal data goes, and most popular AI services are American companies. That doesn't automatically make them forbidden, but it does increase your homework.

Below is what we can actually establish per provider, why Mistral is the simple answer for most people, and which three things you can arrange today without switching services.

Why the GDPR changes the conversation

The GDPR doesn't look at how good a model is, but at three things: do you have a legal basis to process the data, do you know where it is processed, and are there agreements with the party doing it for you.

That third point is where it usually goes wrong. A personal subscription is meant for you as a consumer. If you use it to process data of customers or patients, you act as a data controller without the accompanying agreements. For yourself you can enter whatever you like; for other people's data, that doesn't hold.

The second point is about location. Processing outside the EU requires a valid basis for transfer, and that isn't the same for every country. There is no adequacy decision for China; that is the formal recognition that a country offers an equivalent level of protection. For a service running there, the verdict is quickly reached.

A more extensive explanation of the terms, including what a data processing agreement is exactly, is in AI and privacy in the Netherlands.

What we can establish per provider

Below is only what we have been able to verify. Where we haven't found a documented commitment on processing location for consumer plans, we say so. That is less satisfying than a green checkmark, but it is more honest.

The conclusion from this table is not "everything outside the EU is forbidden". It is: if data residency is your first criterion, the list gets short, and then Mistral is at the top.

Mistral: the simple answer

Mistral is a French company that processes data in the EU, in France and Sweden. That simply makes the transfer question irrelevant, and it is the main reason it is our default recommendation for anyone who puts privacy first.

Le Chat is free to use. Le Chat Pro costs $14.99, so €15.76 per month including VAT, and unlocks among other things a mode without telemetry. Students pay $5.99 (€6.30), teams $24.99 per user (€26.27). Coincidence or not, that also makes it the cheapest Pro subscription of all the major providers.

In terms of capability you give something up. Mistral Medium 3.5, the workhorse model from April 2026, has a context window of 256K tokens, against 1 million for Claude, Gemini and GPT-5.6. For ordinary chats and documents you won't notice; for an archive of attachments in a single conversation you will. On Dutch, Le Chat scores 4 out of 5: surprisingly good and neutral in tone, with colloquial language as its weak spot. See ChatGPT alternative for Dutch for that comparison.

A second advantage that is often forgotten: Mistral releases models openly. Mistral Large 3 and Mistral Small 4 are under Apache 2.0, Mistral Medium 3.5 under a modified MIT license. If you don't want to send any data out at all, you can host such a model yourself. The same goes for Muse Glimmer, the 30-billion-parameter model Meta released under Apache 2.0 in August 2026, which runs on a single consumer GPU.

Microsoft and the EU Data Boundary

For organizations, Microsoft is a serious route, because there is an explicit EU Data Boundary for business customers: processing and storage within the European Union. That is a stronger commitment than what most competitors offer consumers.

In practice: the standalone Copilot Pro subscription no longer exists. For consumers, Microsoft 365 Premium ($19.99, about €21) is the replacement. For business, Microsoft 365 Copilot Business currently costs $18 per user on promotion, down from a list price of $21, about €19 per user. The enterprise version is $30 per user, about €32.

Copilot's weak point is language: a 3 on our scale, because it falls back on English in long answers. So you choose Microsoft for the infrastructure and the Office integration, not for its Dutch writing. For Dutch freelancers (zzp'ers) and small businesses, we lay out the trade-off between business and consumer plans in AI for freelancers and small businesses.

What to stay away from

DeepSeek is technically impressive and completely free: DeepSeek V4 works with 1 million tokens of context and the weights are public. There is no paid consumer plan, so there is no plan with better terms either.

But the service runs in China, and there is no adequacy decision for China. For personal data and customer information, that is a conclusive argument not to use it. If you still want to work with the DeepSeek models, the open weights let you use a version hosted elsewhere; then the question is where that host is located, not where DeepSeek is.

What the AI Act means for you

Briefly and without mystique: the European AI Act mainly places obligations on the providers of AI systems, not on you as a user of a chatbot. It is about transparency, risk classification and documentation on the side of whoever builds the system or puts it on the market.

For your daily practice it changes little about the core question. The AI Act says nothing about where your data is processed; that remains the territory of the GDPR. A provider that complies with the AI Act is therefore not automatically the provider you can put your client files into. The reverse is also true: processing in the EU doesn't make you compliant if you lack a legal basis.

What you can arrange today

Three steps, in order of payoff.

Separate personal use from client work. For other people's data, use a business plan with the accompanying terms, or a provider that processes in the EU. For your own shopping list it makes no difference.

Turn off training and go through your settings. This takes five minutes per account and is the cheapest measure there is.

Choose your default tool deliberately. If privacy weighs more heavily than the last percent of model quality, make Le Chat your default and use the rest only for work without sensitive content. Why more and more Dutch users are going that way is described in Dutch users and European AI.

With us you can use models side by side in one Dutch subscription of €12.95 per month (€129 per year), with invoices in euros including VAT. What we don't solve with that: if a model runs at an American provider, our invoice doesn't change that. What we do is make choosing per task easy, so you can keep sensitive work with a European model without taking out a second subscription.

Conclusion