Fine-tuning, privacy, and GDPR: the legal risks companies often overlook

Fine-tuning sounds attractive: train a model with your company's data and make it your own. But when that data includes personal information, confidential documents, client material, or regulated content, the privacy questions become serious.

For many companies, retrieval augmented generation is a safer first step.

What fine-tuning changes

Fine-tuning modifies model behavior using a training dataset. That can be useful for tone, format, classification patterns, or narrow repetitive tasks. It is not usually the best way to make a model remember changing company knowledge.

If the goal is answering questions about current documents, RAG is usually more appropriate because the model retrieves the latest source instead of encoding information into weights.

Privacy risks

Companies should be careful with:

• Personal data in training sets.
• Client confidential information.
• Trade secrets.
• Data retention by vendors.
• Difficulty deleting specific training examples.
• Lack of source traceability in answers.
• Unclear legal basis or purpose limitation.

These concerns do not mean fine-tuning is never allowed. They mean it needs a clear purpose and controls.

Why RAG is often a better first step

With RAG, documents stay in a controlled knowledge base. The assistant retrieves relevant passages at answer time and can cite the source. If a document changes or must be removed, the system can update retrieval without retraining a model.

That makes governance easier for many internal knowledge use cases.

The practical conclusion

Fine-tuning is a useful technique, but it should not be sold as the default solution for every company knowledge problem. If the information changes, needs citations, or involves access control, start with RAG.

Polp uses that logic: connect documents, retrieve relevant sources, answer with citations, and respect permissions.

Sources:

• Extracting Training Data from Large Language Models - Carlini et al.
• General Data Protection Regulation
• Spanish Data Protection Authority
• European Data Protection Board