GDPR for AI Chatbots: A Practical Checklist

An AI chatbot handles personal data the moment a customer types their name, number or order. GDPR doesn't ban chatbots — it asks you to be clear, collect only what you need, keep it only as long as necessary, and stay in control of the providers behind it.

In Short

Pick a lawful basis for each purpose, tell people at the start that they're talking to AI and how their data is used, minimise and delete, avoid solely automated decisions with significant effects, run a DPIA where risk is high, and sign processor terms with every provider.

The Checklist

  1. Lawful basis. Answering a customer's question is usually contract or legitimate interests; marketing usually needs consent (GDPR Article 6) (GDPR).
  2. Transparency. Say who you are, what the chatbot does with data and where to read more (Articles 13–14), and that it's AI (EU AI Act Article 50).
  3. Data minimisation. Ask only for what the task needs; don't collect ID numbers or health data in chat unless you must (Article 5).
  4. Storage limitation. Set retention periods for transcripts and recordings and delete automatically.
  5. Automated decisions. Don't let the bot alone make decisions with legal or similarly significant effects, such as refusing credit; offer a person (Article 22).
  6. DPIA. Assess high-risk processing — for example large-scale special category data — before launch (Article 35).
  7. Processors. Sign data processing terms with your messaging and AI providers and check where data is stored and whether it trains their models (Article 28).
  8. Rights requests. Be able to find, export and erase a customer's conversations.

What to Say in the First Message

Keep it short: "Hi, I'm the Nova & Co AI assistant. I can help with bookings and orders. Reply HUMAN for a person. Privacy: novaco.com/privacy." That covers AI disclosure, a route to a person and where to find the privacy notice.

How Arino One Helps

Arino One runs on your own platform with configurable retention, consent records, erasure tools and AI disclosure in the opening message. See Compliance and handling erasure requests.

FAQ

Do I need consent to use an AI chatbot?

Not always. Answering questions a customer sends you can usually rely on contract or legitimate interests. Marketing and some sensitive uses need consent. This is general information, not legal advice.

Can my AI provider train on customer chats?

Only if your contract and privacy notice allow it. Most businesses choose providers and settings where customer data isn't used for training.

Is a DPIA required for a chatbot?

A DPIA is required where processing is likely to be high risk, for example large-scale processing of health data. Many simple service bots won't need one, but documenting the assessment is good practice.

How long should I keep chat transcripts?

Only as long as you need them for the purpose, such as handling the request, complaints or legal obligations. Set a period and delete automatically.

Next Step

Not Sure Which Fits?

Find the right setup for your team, or start your own Arino One Studio.

Get Started

Start with the free Remix or a managed plan from $99/month. Providers bill you directly. Compare Plans

WhatsApp