PIPELINEGuide
Chatbot and data protection: what you need to know legally
A chatbot processes personal data the moment someone types their name. What that actually means.
A chatbot processes personal data the moment someone enters their name — that's the starting point of any data protection assessment. For a simple FAQ chatbot, what's usually sufficient in practice: European provider, data processing agreement, deletion period of a few weeks, notice in the chat window itself, and AI labeling under the EU AI Act. Three things are almost always missing in practice: the defined deletion period, the notice in the chat window, and clarification of whether the provider uses data for training. An impact assessment is usually not required for low-risk cases.
01
What gets processed
Chat histories regularly contain more than planned: names, phone numbers, addresses, sometimes health or contract data. That's the starting point of any data protection assessment.
02
The basics
Specify legal basis, define purpose, maintain data minimization, set deletion periods, inform data subjects. Plus a data processing agreement with the provider and verification of where processing takes place.
03
Where it gets stuck in practice
Three things are almost always missing: a defined deletion period for chat histories, a notice in the chat window itself rather than only in the privacy policy, and clarification of whether the provider uses the data for training.
04
The AI Act level
In addition to GDPR, the transparency requirement has applied since August 2026: users must be able to recognize that they're speaking with an AI system. That's a separate requirement not fulfilled by the privacy policy alone.
05
What's practically sufficient
For an FAQ chatbot without capturing sensitive data: European provider, data processing agreement, deletion period of a few weeks, notice in the chat window, section in the privacy policy, AI labeling. An impact assessment is usually not required.
06
What's often missing in practice
Many chatbots store histories indefinitely because no one set a deletion period during setup — not from negligence, but because no one explicitly decided it. A period of a few weeks belongs in the configuration from the start, not in a later fix.
Questions
Frequently asked questions
Do we need a data protection impact assessment?
Only when there's a likely high risk — such as extensive profiling or systematic processing of sensitive data. For an information chatbot, it's usually not necessary. The assessment should still be documented.
Can chat histories be stored?
Yes, with purpose and time limit. For improving the bot and tracking inquiries, limited storage is permissible. Unlimited storage is not.
What about chatbots from US providers?
Possible, but more complicated: you need a valid basis for data transfer and documented assessment. For most small businesses, a European provider is the simpler route.
Next step
Send us a few sentences about your project.
We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.