Guide

AI chatbot and data protection: what the GDPR requires

As soon as personal data is processed by an AI chatbot, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.

Request assessment ↗AI chatbot

Quote upon request2 to 4 weeksStatus 2026

In short

As soon as personal data is processed by an AI chatbot, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.

01 — Data Protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, this means for an AI chatbot: a data processing agreement with every service provider involved, checking where processing takes place, a documented deletion period, and an understandable passage in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

02 — Contract

What needs to be clarified in writing

Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
Handover upon termination. In what format, within what timeframe, at what cost.
No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
Documentation as a deliverable. Not as a promise, but as a line item in the proposal.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

What happens to our customers' data?

The conversations run through servers in the EU, no training is done with your data, and we write the appropriate section for your privacy policy. On request, chat logs are automatically deleted after a set period.

Does this also work on a WordPress site?

Yes. The integration is a single code snippet in the footer and works the same on WordPress, Shopify, Webflow, Wix, TYPO3, or a custom-built site.

Can we turn the bot off again?

Anytime, with one click. The snippet remains, the bot is gone. There's no minimum term that binds you.

Does this even pay off for us?

The calculation is simple: requests per week times processing time times hourly rate. With twenty repeat questions per week and seven minutes each, that's a good two hours of work — every week. We calculate this with your real numbers before the quote.

How much work does this create for us?

At the start, about two to three hours for gathering content and one alignment round. After that, nothing regular — unless you want to add new topics, which works through a simple document.

Doesn't an AI chatbot just make up answers?

A free-running language model does. That's why we build the bot so it only answers from a verified knowledge base and provides the source. If it finds nothing, it says so and redirects — that's the most important part of the configuration.

What if the bot answers a question incorrectly?

You see every conversation. Incorrect answers are refined by making the knowledge base more precise. This happens a few times in the first weeks, then rarely after that.

05 — Next

AI chatbot by region

Next step

Send us a few sentences about your project.

We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203