Chatbot GDPR Compliance: The Rules to Follow, with a Checklist
In short
An AI chatbot processes personal data, so it must comply with the GDPR. You need a legal basis, clear information, minimal data collection, a retention period, a contract with every processor and safeguards for transfers outside the EU. Since August 2, 2026, the AI Act also requires telling users they're talking to an AI.
Key takeaways
- As soon as a visitor types their name, email or a personal question, the GDPR applies to the chatbot.
- Every processing activity needs a legal basis, often contract performance or legitimate interest.
- The chatbot vendor and the AI model provider are processors: an Article 28 contract is mandatory.
- Since August 2, 2026, the AI Act requires informing users that they're interacting with an AI.
- This article is general information, not legal advice: have your own case reviewed.
Does the GDPR apply to a chatbot?
Yes, as soon as the chatbot processes data that can identify a person. A first name, an email address, an order number or a question about someone's situation is enough.
The GDPR regulates data processing, not technology. An AI chatbot is neither banned nor compliant by default: it all depends on how it's built. This guide walks through what to plan, followed by a checklist.
One important caveat: this article is general information, not legal advice. Have your choices reviewed by a lawyer or your data protection officer for your specific situation.
What legal basis does a chatbot need?
Every use of personal data must rely on one of the six legal bases in Article 6 of the GDPR. For a chatbot, three come up most often.
| Chatbot use | Common legal basis |
|---|---|
| Answering a question about an order or service | Performance of a contract or pre-contractual steps |
| Improving answers based on conversations | Legitimate interest, after a balancing test |
| Sending sales offers afterward | Consent, or direct marketing rules |
| Processing health data or other sensitive data | Stricter conditions of Article 9, best avoided |
Record the legal basis for each use in your register of processing activities. If you can't justify it, the data probably isn't needed.
How should you inform chatbot users?
Users need to know, before or at the start of the conversation, who processes their data, why and for how long. That's the information required by Article 13 of the GDPR.
In practice:
- a short message in the chat window, with a link to your privacy policy;
- a dedicated chatbot section in that policy: purposes, legal basis, retention, processors, transfers, rights;
- a clear statement that the assistant is an AI, not a person.
That last point is also an AI Act obligation, covered below.
What data should you collect, and for how long?
The chatbot should collect only what's necessary and keep it only as long as needed. These are the data minimization and storage limitation principles of Article 5.
A few practical habits:
- only ask for an email or phone number when the follow-up requires it, such as a callback;
- instruct the chatbot never to request sensitive data or card numbers;
- automatically mask unnecessary data in logs, such as account or national ID numbers;
- set a retention period for conversations, then delete or anonymize them automatically.
At Ozapp, solutions are hosted on European servers and clients remain the owners of their data and conversations.
Who are a chatbot's processors?
Any vendor that processes data on your behalf is a processor, and Article 28 of the GDPR requires a contract with each one. A chatbot often involves several links in that chain.
- The vendor that builds and hosts the chatbot.
- The AI model provider (OpenAI, Anthropic, Google or another).
- The channels: Meta, for example, if the chatbot answers on WhatsApp or Messenger.
- Connected tools: CRM, calendar, online store, ticketing system.
For each one, check the data processing agreement, whether data is used for training and where it's processed. Business plans from the major providers generally exclude training by default; we compare those options in chatbot vs ChatGPT.
What about data transfers outside the European Union?
Transfers outside the EU are allowed, but they must follow the safeguards in Chapter V of the GDPR. For the United States, two frameworks are common.
- The EU-US Data Privacy Framework: the European Commission adopted an adequacy decision on July 10, 2023, for certified US companies.
- Standard contractual clauses, together with an assessment of the transfer risk.
Often the simplest route is choosing services that process or store data in Europe. OpenAI, for example, offers data residency in Europe for its API and Enterprise plans, for eligible customers.
How do you handle individual rights?
Chatbot users keep all their rights: access, rectification, erasure, objection, restriction and portability. Your organization must respond within one month, under Article 12.
In practice, you need to be able to find, export and delete a person's conversations. Also plan for cases where the chatbot makes or prepares a significant decision about someone: Article 22 restricts fully automated decisions. Handing over to a person is then the safest option.
What does the AI Act change for a chatbot?
The AI Act adds a transparency duty: people must know they're talking to an AI. Article 50 of Regulation (EU) 2024/1689 has applied since August 2, 2026.
For a customer service chatbot, this boils down to three measures:
- a welcome message that introduces the assistant as an AI;
- a visible label in the interface;
- a way to reach a human when the request calls for it.
A standard customer service chatbot generally doesn't fall into the AI Act's high-risk categories. That changes if it's used, for example, to screen job applicants or assess someone's creditworthiness, which calls for a specific assessment. For agents that take actions in your tools, also read our article on AI agents.
What does Belgium's Data Protection Authority say?
In Belgium, the Data Protection Authority (APD/GBA) enforces the GDPR. In September 2024, it published an information brochure on AI systems and the GDPR.
The brochure applies GDPR and AI Act principles to AI: lawfulness, transparency, minimization, accuracy, security and accountability. It's a solid starting point for scoping your project with your lawyer.
Checklist: is your chatbot ready?
Check these ten points before going live.
- The chatbot introduces itself as an AI in its first message.
- A link leads to a privacy policy that covers the chatbot.
- The legal basis for each use of data is documented.
- The chatbot only asks for necessary data and refuses sensitive data.
- A retention period is set and applied automatically.
- An Article 28 contract is in place with every processor.
- Transfers outside the EU are identified and safeguarded.
- You can find, export and delete a person's conversations.
- A human handover exists for sensitive requests or significant decisions.
- The processing is in your register, with an impact assessment if the risk is high.
For the rest of the project, our AI chatbot for business guide covers the setup steps. If your chatbot also answers on WhatsApp, read our article on the WhatsApp chatbot for business.
Take the next step
A compliant chatbot is designed that way from day one, not fixed after launch. Explore our AI chatbot service, hosted on European servers, and try the live demo on your own website; it's also among our AI demos. Free 30-minute consultation and a quote within 24-48 hours.
Frequently asked questions
Does a chatbot have to say it's an AI?
Yes. Article 50 of the EU AI Act, applicable since August 2, 2026, requires informing people that they're interacting with an AI system, unless it's obvious. The simplest approach is a welcome message such as 'Hi, I'm the company's virtual assistant' plus a visible label in the chat window.
Do I need consent to use a chatbot on my website?
Not necessarily for the conversation itself. Answering a question can rely on pre-contractual steps or legitimate interest. Consent becomes necessary for non-essential cookies, direct marketing or certain sensitive data. You choose the legal basis for each processing activity and document that choice.
How long can I keep chatbot conversations?
The GDPR sets no fixed period: you define one based on the purpose and stick to it. A customer service conversation can be kept while the request is handled and the chatbot is improved, then deleted or anonymized. What matters is setting the period, disclosing it and automating it.
Can I use a US-based AI model and stay GDPR compliant?
Yes, with the right safeguards. Transfers are possible if the provider is certified under the EU-US Data Privacy Framework or has signed standard contractual clauses. Many providers also offer processing or storage in Europe. Either way, record the transfer in your processing register and privacy policy.
Who enforces the GDPR in Belgium?
The Data Protection Authority (APD in French, GBA in Dutch). It provides guidance, handles complaints and can impose sanctions. In September 2024, it published a brochure on AI systems and the GDPR, which is useful for scoping a chatbot project. For a specific case, consult a lawyer or your data protection officer.
