AI coding assistants and GDPR

The question is not whether AI is allowed

Nothing in data protection law singles out AI coding assistants, and no regulator has banned them. The reason the question keeps coming up is that a cloud assistant quietly changes two things about your engineering setup, and both of them are things your organisation already has a process for.

• It can add a processor. If personal data in your repository is sent to a vendor so the vendor can do something with it, that vendor is handling personal data on your behalf. Your organisation has a routine for onboarding a party in that position: contracts, security review, a place on a register.
• It can add an international transfer. Inference usually happens wherever the vendor runs GPUs, which is frequently not where your company is. That is a separate assessment from the first one.

Neither is a prohibition. They are work, and they are work that has to be redone every time a vendor changes a subprocessor. The reason local inference keeps coming up in these conversations is not that it is more compliant, it is that it does not start the process at all, because the data never goes anywhere for the inference step.

First, decide whether your source tree contains personal data

Most teams answer “no, it is just code” and most teams are wrong, not because the source files are full of names, but because of everything that sits beside them in the same repository.

• Test fixtures built from a production export. The single most common case, and the one nobody remembers when they answer the question.
• Seed data and migrations carrying real rows because somebody needed a realistic dataset once.
• Logs and stack traces checked in as reproduction cases, with user identifiers, email addresses or tokens inside them.
• Configuration and infrastructure files naming staff, mailboxes, on-call contacts or customer subdomains.
• Comments, commit messages and issue links that name individuals and describe what was done about them.

If the answer is that there is personal data in there somewhere, that does not end the discussion. It just means the discussion is a data protection one rather than a purely technical one, and it is worth knowing that before a reviewer discovers it for you.

What changes when inference is local

With a cloud assistant, the prompt and its context leave your equipment. The vendor becomes a party in the handling of whatever was in that context, their subprocessors come with them, retention becomes a question you have to ask, and the location of the processing becomes a thing to assess.

With Onyx Code in its default mode, the model runs on the same machine as the editor, over the loopback interface. For the inference step there is no recipient, so the questions about contracts, subprocessors, retention and transfer locations do not have anything to attach to. That is a factual statement about where the computation happens, not a claim that your obligations are discharged, and your DPO will still want to know about the machine itself, the people using it, and what else the software does.

Two honest qualifications, because a page like this is worthless if it hides them.

• Bring-your-own-key changes the answer. If you add an OpenAI, Anthropic, Groq or Mistral key and send a prompt to it, that call goes to that provider under their terms, exactly as it would from any other tool. It is off by default, it is a per-task choice, and Air-Gap Mode blocks it outright, but it exists and a reviewer should be told it exists.
• Local processing is still processing. Running a model on your own hardware does not make the data stop being personal data. What it changes is who is involved, not what it is.

The questions a DPO or security reviewer actually asks

Taken from the shape these reviews usually follow. The right-hand column is what Onyx Code does, so you can see which questions still need work and which stop being questions.

Notice which of those a policy document cannot answer. “Can we prove what it touched” is the one that turns a vendor assurance into evidence, and it is the reason the Activity Log exists.

Where the EU AI Act fits, as of August 2026

This comes up in the same meeting, so it is worth separating from data protection rather than letting the two blur together.

The Act entered into force in August 2024 and phases in. The prohibitions and the AI-literacy duty in Article 4 have applied since February 2025, general-purpose AI transparency duties from August 2025, and the Act’s general application together with the Article 50 transparency duties from 2 August 2026. The high-risk obligations for the standalone systems listed in Annex III are deferred to December 2027, and high-risk AI embedded in already-regulated products to August 2028.

A coding assistant is not usually one of the Annex III categories, which are things like hiring, credit scoring, education and critical infrastructure. For most engineering organisations the parts that touch them first are therefore the literacy duty, which is about the people using the tools, and transparency, which is about telling people when they are dealing with AI output.

What you can put in front of a reviewer

A data protection review ends with somebody wanting artefacts rather than assurances.

Whatever the framework, a review comes down to the same two questions: what did the tool touch, and can you show it. Onyx Code answers both from the machine rather than from a vendor policy page.

• AI Activity Log. Every prompt, every file the AI read, every edit it proposed, with timestamps, recorded locally.
• Audit PDF export. The same record as a document you can hand to somebody who is never going to open your editor. This is usually the artefact that ends the conversation.
• .onyxnoai exclusion patterns. Gitignore-style paths no AI surface may read: not chat, not the index, not autocomplete, not agents. It lives in the repository, so it is reviewable in a pull request and it travels with the code.
• Prompt sanitizer. Every send and attachment is scanned locally for credentials, keys, tokens and certificates, with redaction offered before the prompt is built.
• Air-Gap Mode. A switch that blocks outbound traffic, enforced in three independent layers, with blocked attempts written to the log.
• No telemetry by default. Nothing to disable and nothing to negotiate.

All of the above are on the Free tier. Privacy and audit features are never behind the paywall, which also means a reviewer can evaluate every one of them before anybody spends money. The air-gapped development page covers the enforcement mechanisms in more depth, and the documentation gives the commands to verify them independently.

Questions

Can you use AI coding assistants under GDPR?

Organisations do, routinely. The work is in deciding whether your repository contains personal data and, if it does, handling the vendor as a party to that data with the contracts, assessments and register entries your organisation already uses for any other vendor. A tool that performs inference locally does not create that relationship for the inference step, which is why it comes up so often in these discussions.

Does source code count as personal data?

The code itself usually does not. What sits next to it often does: fixtures built from production exports, seeded databases, checked-in logs and stack traces, configuration naming individuals, and comments about people. Since an assistant indexes and retrieves across the workspace rather than reading only your open file, the scope of the question is the repository.

Does local inference remove our obligations?

No, and anyone who tells you otherwise is selling something. It removes a recipient from the picture for the inference step. You are still processing, on equipment you are responsible for, and the rest of your programme still applies.

What if a developer uses a cloud model anyway?

Bring-your-own-key is supported and off by default, so it is a deliberate act. Where that should not be possible at all, Air-Gap Mode blocks outbound traffic in three enforcement layers and logs the attempts, and the per-workspace AI kill switch turns off every AI surface for one repository.

Can we show an auditor what the AI did?

Yes. The AI Activity Log records prompts, file reads and proposed edits with timestamps and exports as a PDF. It is a local record on a machine its user controls, so treat it as evidence of what the tool did rather than as a tamper-evident chain of custody.