AI data boundaries on Mac: a GDPR review checklist

Local execution is one part of the data flow

LMCP runs local tools on your Mac and can read supported apps and files using the permissions you grant. The tool result is returned to your AI client. If that client uses a cloud model, the provider receives the requested content. A desktop application does not by itself imply on-device model inference.

Web assistants connect through the optional Cloud Relay. Requests and tool results pass through that connection; it is not a way to use a cloud assistant without disclosing its requested data to the provider. Connected services such as Microsoft 365 or Google Drive have their own authentication and data flows.

Do not treat architecture as a compliance certificate

Local execution alone does not establish GDPR or CCPA compliance. Your assessment must consider the personal data involved, why it is processed, who receives it, your chosen providers and configuration, and your organizational requirements. Review the applicable provider terms with your privacy or legal team.

macOS permission prompts control technical access to apps and files. Granting an operating-system permission is not, by itself, proof that the whole AI workflow meets your legal obligations.

Review the workflow before using personal data

1. Identify the exact tool, platform, accounts and resources needed for the task.
2. Check whether model inference is on-device or hosted by an external provider.
3. Review provider retention, training, access and regional-processing settings and terms.
4. Authorize only the necessary data and avoid using real sensitive records for initial tests.
5. Check each tool's current permission and confirmation behavior; it varies by tool, platform and client.
6. Have your organization assess its obligations and any provider agreements before production use.

A genuinely local model configuration

A compatible client using an on-device model can keep inference on your computer when it uses only local integrations and does not enable external services. Check the complete configuration, including model selection, optional connectors and relay use, rather than relying on an app's name.

Getting started

Use the installation guide, review the platform-specific tool reference, and test with non-sensitive sample data. Keep approval decisions separate from model-generated suggestions.

Related guides

• Email access: local tools and cloud model boundaries
• Connect an AI client to Apple Mail
• Healthcare workflow data boundaries