Security
Who is the controller and who the processor, which legal basis carries the moderation of other people's comments, what belongs in the processing agreement, and why minimising the data before the model call is the technical step that matters most.
Published · September 3, 2026 · Tim Urbutt · 10 min read
01
The most important sentence first: a comment under your post is personal data belonging to the person who wrote it - not to you. You are the controller within the meaning of Article 4(7) GDPR, because you decide on the purposes and means of the moderation. Doorman processes on your behalf and is a processor under Article 4(8).
That sounds formal, but it has a very practical consequence: when somebody contacts you, you have to be able to answer - and you should not have to ask us first. Everything else in this article follows from that division of roles.
02
Consent from the commenter is practically out of reach: it would have to be obtained before the comment and be withdrawable at any time. In practice moderation rests on legitimate interests under Article 6(1)(f) - the page operator's interest in keeping their own comment section free of hate, spam and fraud.
That requires a balancing test, and you write it down once. Three points usually carry it: processing is limited to the published comment text, the effect is reversible - hidden is not deleted - and a person can review every decision. A balancing test you did not document is a balancing test you do not have.
Legitimate interest is not a catch-all clause. It is a calculation you have to be able to show.
03
Article 5(1)(c) requires data to be adequate, relevant and limited to what is necessary. In an AI-assisted moderation tool that is not decided in the text of a privacy notice. It is decided in the payload of the request that goes to the model.
A comment text without a sender is, in the vast majority of cases, no longer personal data - unless somebody names themselves in the text. Sending the whole record to a model instead moves a decision about personal data into another country to save a line of code. That shortcut is the difference between processing you can explain and processing you have to defend.
04
Article 28(3) enumerates what a DPA has to cover. In practice it is six things you should ask every tool for - us included.
Ask for one more thing in writing that no template DPA contains: is my content used to train models? The answer is not in the marketing but in the model provider's terms.
05
Article 5(1)(e) calls it storage limitation: personal data may be kept in identifiable form only for as long as the purpose requires. The purpose of moderation ends once the comment is handled - your statistics do not need it in clear text after that.
| Data | Window | What remains |
|---|---|---|
| Comment text, author name and profile id | 30 days | Anonymous skeleton: status, verdict, timestamp |
| Reply logs and Copilot drafts | 30 days | The entry, without any text |
| Skipped comments | 7 days | Nothing, they are deleted outright |
| Your rules, reply library and knowledge documents | As long as your account exists | Nothing, they go with the account |
One detail that is often overlooked: backups. A dump taken on day D contains the text of every comment from the 30 days before it. Kept longer than the retention window, the window is only half true. Ask about it - it is the question that separates a deletion concept that is meant from one that is merely written.
06
| Right | Article | What it means here in practice |
|---|---|---|
| Access | Art. 15 | For every comment you can see when it was checked and which rule matched |
| Erasure | Art. 17 | Immediately on request, otherwise automatically after 30 days |
| Restriction | Art. 18 | A channel can be paused without losing data |
| Objection | Art. 21 | Automatic pre-screening can be switched off per channel |
| Human intervention | Art. 22(3) | Every automatic decision is reviewable and reversible by you |
07
As a rule, no. Consent from the commenter would have to be obtained before the comment and be withdrawable at any time - practically impossible. The usual basis is legitimate interests under Article 6(1)(f), supported by a documented balancing test. Have the legal basis checked for your case rather than copying this paragraph.
Article 22 applies to decisions producing legal effects or similarly significant effects. Whether hiding a single comment reaches that threshold is contested. The pragmatic route is not to leave the question open: if a person can inspect every decision and reverse it with one click, the right to intervention in Article 22(3) is satisfied regardless of how you read the threshold.
Article 35 requires one where processing is likely to result in a high risk, in particular for large-scale systematic monitoring of publicly accessible areas or large-scale processing of special categories. At high comment volumes the check is worth doing. We provide the building blocks - description of processing, recipients, processing locations, windows and measures - while the assessment stays with you.
No. Comments, rules and knowledge documents are not used to train or fine-tune models. The contractual assurance from the providers we use comes with the data processing agreement.
08
Last reviewed: 3 September 2026. This article describes the technical behaviour of the product and is not legal advice.
Write to us — we are happy to help with a concrete answer.
Nordify UG (haftungsbeschränkt), Hamburg