GDPR and AI chatbots: What to know before going live

GDPR and AI are two words that make many European business owners frown. Rightly so: it's hard to keep track of which rules apply, which vendors you can use, and what you need to do before putting an AI chatbot live on your website.

This is a pragmatic guide. It covers the seven questions you, as data controller, need to answer, and ends with a checklist for the day you go live. It is not legal advice. If you handle sensitive data, work in a regulated industry, or are in the public sector, check with your data protection officer.

Updated 28 September 2026 with more on sub-processors and US transfers, the AI Act's transparency rules, and a go-live checklist.

Question 1: Does the chatbot process personal data?

Almost always, yes. An AI chatbot typically processes:

• The chat messages themselves, which often contain personal data: a name, an email address, a description of a problem, an order number
• Technical data such as IP address and browser type
• Timestamps and session data
• Depending on the product: cookies or data stored in the visitor's browser

And visitors can type anything. Sooner or later, someone will type an ID number or a health detail into the box, even if your chatbot only answers questions about shipping.

As the company behind the website, you are the data controller for data collected through the chatbot, even when a vendor runs the technology.

Question 2: Who is the data processor, and do you have a DPA?

The chatbot vendor is usually the data processor. They process personal data on your behalf, and GDPR Article 28 requires a written Data Processing Agreement (DPA) between you.

Check that the DPA:

• Describes which data is processed, for what purpose, and for how long
• Commits the vendor to act only on your instructions
• Describes the security measures
• Covers deletion or return of data when the agreement ends
• Lists the sub-processors and commits the vendor to notify you of changes
• Commits the vendor to help you when a visitor exercises their rights

If a vendor can't produce a DPA, treat that as a warning sign.

Question 3: Who are the sub-processors, and where do the language models run?

This is where answers get vague. An AI chatbot is rarely one company: one provider's language model writes the answers, another turns text into searchable vectors, and others handle crawling, storage, payments and email. Each one that processes personal data on the vendor's behalf is a sub-processor.

Ask any vendor four questions:

1. Where do the language models run? Which provider writes the answers, in which country, and is there a backup model?
2. Who are the sub-processors, and what do they do? Ask for the full list with role and location. "We use reputable cloud providers" is not an answer.
3. What is the transfer basis? If a sub-processor is outside the EU/EEA, the transfer needs a valid legal basis.
4. How are you notified of changes? You should be able to object before a new sub-processor is added.

For transfers to the US, there are two bases in practice:

• EU-US Data Privacy Framework (DPF): the European Commission's 2023 adequacy decision, which only covers certified US companies. The EU General Court upheld it in September 2025, but the ruling has been appealed to the Court of Justice. It applies today, but it isn't beyond challenge.
• Standard Contractual Clauses (SCCs): contracts approved by the European Commission. They require a transfer assessment and, where needed, supplementary measures. A vendor with SCCs as a fallback is better placed if the DPF falls.

A concrete example: Asktopus' sub-processors

Our list, as published in our privacy policy:

US transfers rely on the DPF or, where applicable, SCCs. We notify customers before adding or replacing a sub-processor that processes visitor data.

So we don't promise that data never leaves the EU. To answer, the visitor's question and the relevant excerpts of your content are sent to language models in the US. If a vendor promises "EU only", ask which language model writes the answers and where it runs.

Question 4: What is the legal basis for processing?

You need to point to one of the six legal bases in GDPR Article 6:

• Consent: The visitor explicitly agrees. It must be freely given and specific, and a generic cookie banner is not enough.
• Performance of a contract: If the chat is necessary to deliver an agreed service.
• Legitimate interest: The most common basis for customer service. Requires a written legitimate interest assessment.
• Legal obligation or vital interests: Rarely relevant for chatbots.
• Public task: Relevant for municipalities and public authorities.

For an ordinary business website, legitimate interest is often the right basis for the chat itself. Consent may become necessary if you use conversation data for marketing or analytics beyond operations.

Question 5: How long is data retained?

GDPR requires that you only keep data as long as necessary. The law names no fixed number of days. What matters is that the period fits the purpose, that it's stated in your privacy policy, and that the data is actually deleted. For chat conversations, 90 days is a sensible default: long enough to review conversations, spot content gaps over a quarter and follow up on requests, but no longer.

Ask the vendor:

• How long are conversations kept by default, and can that be shortened?
• Is deletion automatic?
• What applies to backups and log files?
• What happens to the data when you cancel?

Need to keep something longer, say a conversation that led to an agreement? Move it into your own system, under your normal retention rules.

Question 6: How do you handle data subject rights?

Under GDPR, visitors have the right to:

• Access: to see what data you hold about them
• Rectification: to have inaccurate data corrected
• Erasure (the right to be forgotten)
• Restriction of processing
• Data portability: to receive their data in a structured format
• Objection to processing

These rights apply to chat data too. The vendor must help you honor them, so ask how it works in practice: can you find and delete a specific conversation yourself, or do you contact the vendor?

Don't forget the copies: if the chatbot hands conversations to a human by email, Slack or your CRM, that data also lives in your own systems and must be included in your answer.

Question 7: How do you inform visitors?

Visitors need to know what happens to their data before they start, typically in three places:

• Your privacy policy: Describe that you use an AI chatbot, which data is collected, the purpose, legal basis, retention period, who receives the data (the vendor and its sub-processors), and whether data is transferred outside the EU/EEA.
• Your cookie banner: Only relevant if the chatbot sets cookies or stores data in the browser. The Asktopus widget sets no cookies and stores nothing in the visitor's browser.
• In the chat itself: A short line in the greeting that points to your privacy policy.

Since 2 August 2026, the AI Act's transparency rules (Article 50) apply: people talking to an AI must be told so from the first interaction, unless it's obvious. The duty sits mainly with the AI system's provider, but it's your site and your visitors. The simplest fix is the greeting, for example: "Hi, I'm an AI assistant. I answer based on the content of our site."

And update your privacy policy when the chatbot goes live. It's the most commonly missed detail.

Go-live checklist

1. The DPA with your vendor is in place.
2. You have the sub-processor list with locations and transfer bases, and know how changes are notified.
3. Your legal basis is chosen and documented. For legitimate interest: a short written assessment.
4. The chatbot is added to your record of processing activities.
5. Your privacy policy describes the chatbot: purpose, legal basis, retention, recipients and any transfers.
6. The chat clearly says it's an AI, and the greeting points to your privacy policy.
7. The retention period is known and fits your purpose.
8. You know what to do when a visitor asks for access or erasure, including copies forwarded to email, Slack or CRM.
9. Sensitive topics are limited: block topics the chatbot shouldn't answer (such as health or legal advice), and never ask visitors for ID numbers in the chat.
10. Cookies are sorted. If the chatbot sets cookies, your cookie banner covers them.
11. A named person reads the conversations regularly during the first weeks.

Still choosing a solution? See our guide on how to add an AI chatbot to your website.

What does Asktopus do?

Asktopus is built by Uneven Bits ApS in Copenhagen, Denmark. How we handle the points above:

• Roles: We are the data processor for your visitors' chat data, and you are the data controller.
• DPA: Part of our terms. Read it here, or contact us if you need a signed copy.
• Retention: The content of chat conversations is deleted automatically 90 days after the conversation. We keep only a record that it took place (time and number of messages), and backups are kept for up to 30 days.
• Sub-processors: The list is above and in our privacy policy. You're notified before we add or replace a sub-processor that processes visitor data.
• AI label: The widget always tells visitors, in their own language, that they're chatting with an AI that can make mistakes.
• No cookies: The widget sets no cookies and stores nothing in the visitor's browser.
• Protection: You can block topics the assistant shouldn't answer, and built-in prompt injection protection is always on.
• No reselling: We never sell data.

For public sector organizations, we're happy to walk through the DPA together with your data protection officer.

Frequently asked questions

Is it legal to use an AI chatbot that runs on US language models?

Generally yes, if the transfer has a valid basis, typically the DPF for certified companies or SCCs, and it's reflected in your DPA and privacy policy. Public authorities and anyone handling sensitive data should make a more thorough assessment with their data protection officer.

Do visitors need to give consent before they can chat?

Usually not for the chat itself, where legitimate interest is often the right basis. Consent becomes relevant if the chatbot sets non-essential cookies or you use conversations for marketing.

Do visitors need to know they're talking to an AI?

Yes. Under the AI Act, it must be clear from the first interaction, unless it's obvious. If your widget doesn't say it on its own, the simplest way is to say it in the greeting.

What if a visitor types sensitive data into the chat?

You can't prevent it, but you can limit it. Never ask for sensitive data in the chat, block topics the chatbot shouldn't handle, and keep retention short. In high-risk areas such as healthcare, use the greeting to ask visitors not to share that kind of information.

---

Want to see how it works in practice? You can try Asktopus free for 14 days, no credit card required. See the plans on the pricing page.