AI chatbots are no longer a thing of the future – they answer customer enquiries around the clock, take pressure off support teams and noticeably improve the user experience. But anyone who deploys such a bot on their website enters data protection territory that requires careful planning. This article shows what matters, where the typical pitfalls lie and how to implement a chatbot in compliance with the law.
What makes AI chatbots special under data protection law?
Unlike a simple contact form, an AI chatbot processes input in real time, stores conversation histories, transfers data to external services and, in some cases, learns from the interactions. This creates several data protection dimensions at once:
- Collection of personal data – users enter names, email addresses, descriptions of their problems or even health information, often without being aware of it.
- Third-country transfers – many AI services (OpenAI, Google, Amazon) process data on servers in the USA or other non-EU countries.
- Automated processing – as soon as a system makes decisions that affect individuals, Art. 22 GDPR applies.
- Training of AI models – if inputs are used to improve the model, this is a separate processing activity.
The General Data Protection Regulation (GDPR) applies to all of these operations as soon as even a single data subject from the EU is involved.
Legal bases: On what grounds may data be processed?
Every processing of personal data requires a legal basis under Art. 6 GDPR. For chatbots, three are typically relevant:
Consent (Art. 6(1)(a) GDPR) Consent is the safest basis when data processing goes beyond what is necessary to provide the service – for example, when conversation data is used for analytics or AI training. It must be freely given, informed, specific and unambiguous. A pre-ticked box is not enough.
Performance of a contract (Art. 6(1)(b) GDPR) If the chatbot is used to handle an existing or prospective contractual relationship (e.g. checking order status, support requests in the customer account), this basis may apply.
Legitimate interests (Art. 6(1)(f) GDPR) For purely functional chatbot interactions without sensitive data, the company's legitimate interest can be relied on – but only if a balancing of interests comes out in favour of the controller and the users' fundamental rights do not prevail.
Practical tip: For visitors without an existing contractual relationship, consent is usually the appropriate choice.
Technical and organisational measures (TOMs)
Art. 25 GDPR requires "data protection by design" (privacy by design) and "data protection by default" (privacy by default). In concrete terms, this means for chatbots:
Data minimisation The bot should only ask for the data that is actually required for the respective request. Someone who only wants to know the opening hours should not have to enter an email address.
Pseudonymisation and anonymisation Conversation logs should be stored anonymised or at least pseudonymised wherever possible. Real names and direct identifiers should be removed from the logs at an early stage.
Encryption Chatbot data must be encrypted in transit and at rest (at least TLS 1.2, preferably TLS 1.3).
Access restrictions Logs and conversation histories may only be accessible to authorised persons. Role-based access concepts must be documented.
Deletion concept Clear retention periods must be defined for all data processed. Conversation histories should not be kept longer than strictly necessary – a few weeks to months is usually sufficient.
Data processing: The contract with the provider
Anyone who integrates an external AI service – whether via an API or a ready-made widget solution – hands over personal data to a service provider. This constitutes processing on behalf of a controller under Art. 28 GDPR. Without a valid data processing agreement (DPA), using the service is unlawful.
Among other things, a DPA must cover:
- Subject matter and duration of the processing
- Nature and purpose of the processing
- The processor's obligation to follow instructions
- Technical and organisational security measures
- Handling of sub-processors
- Data subject rights and obligations to assist
Many large providers (OpenAI, Microsoft, Google) offer standard agreements. However, these should not be accepted blindly – a legal review is advisable, particularly with regard to sub-processors and their locations.
Third-country transfers: The US problem
A key problem when using US AI services is the transfer of data to third countries. Since the CJEU's Schrems II ruling (2020), transfers to the USA without appropriate safeguards have been inadmissible.
Since July 2023, the EU-U.S. Data Privacy Framework (DPF) has provided a new adequacy decision by the European Commission. Providers certified under the DPF may receive data from the EU without additional standard contractual clauses (SCCs) being required. Whether a provider is certified can be checked at dataprivacyframework.gov.
Important: The DPF is not irrevocable. There are ongoing political and legal debates that could jeopardise its continued existence in the medium term. A risk assessment and regular review remain necessary.
Alternatively, European providers or self-hosted open-source models (e.g. LLMs running on your own infrastructure) offer a more robust solution in terms of data protection, because no transfer to third countries takes place.
Privacy policy: Meeting transparency obligations
The website's privacy policy must describe the use of the chatbot completely and comprehensibly (Art. 13 GDPR). The following information is mandatory:
- What data does the chatbot collect?
- For what purpose is it processed?
- On what legal basis?
- To which recipients (including sub-processors) is data disclosed?
- To which countries is data transferred, and on what basis?
- How long is data stored?
- What rights do users have (access, erasure, objection)?
A general statement such as "We use AI tools" is not sufficient. The description must be specific and comprehensible.
Implementing data subject rights technically
All data subject rights under the GDPR also apply to chatbot data:
- Right of access (Art. 15): Users can request to know what data is stored.
- Right to erasure (Art. 17): On request, it must be possible to delete all personal data from conversation logs.
- Right to data portability (Art. 20): Where processing is based on consent or contract, it must be possible to provide data in a machine-readable format.
- Right to object (Art. 21): Users can object to processing based on legitimate interests.
The technical infrastructure must be able to support these rights. Conversation logs should therefore be structured so that they can be clearly attributed to an individual and deleted completely on request.
Special categories of personal data
If the chatbot processes sensitive data – for example in doctor-patient communication, psychological counselling or legal advice – stricter requirements apply under Art. 9 GDPR. Health data, religious beliefs or political opinions may only be processed with explicit consent or under narrow statutory exceptions.
In such scenarios, a data protection impact assessment (DPIA) under Art. 35 GDPR is almost always mandatory.
Data protection impact assessment (DPIA)
A DPIA must be carried out if a processing activity is likely to result in a high risk to the rights and freedoms of natural persons. This is often the case for AI chatbots, especially if:
- profiling or systematic analysis of user behaviour takes place,
- special categories of personal data are processed,
- large-scale processing takes place on a publicly accessible system.
The DPIA documents risks, countermeasures and the assessment of residual risk, and must be submitted to the supervisory authority if the risks cannot be sufficiently mitigated.
Practical checklist for GDPR-compliant use of AI chatbots
Legal basis
- Legal basis determined for each processing activity
- Consent mechanism (if required) technically implemented
- DPA concluded with the provider and reviewed
Transparency
- Privacy policy updated and complete
- Users are informed about data processing before their first input
Technology
- Transmission and storage encrypted
- Retention periods defined and technically implemented
- Data subject rights can be fulfilled (access, erasure, portability)
- Data minimisation implemented (only necessary fields)
Third-country transfers
- Provider checked for DPF certification or SCCs
- Transfer documented
Risk assessment
- DPIA carried out (if required)
- Record of processing activities updated
Conclusion
An AI chatbot can be a valuable addition to any website – provided it is designed to comply with data protection law from the outset. The greatest risks do not arise from bad intent, but from missing contracts, unclear legal bases and a lack of transparency towards users. Those who consistently implement the measures described create not only legal certainty but also trust among their users – and that is ultimately the more sustainable competitive advantage.
In complex scenarios, especially in regulated sectors such as healthcare, finance or law, it is also advisable to involve a specialised data protection officer or lawyer.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
