AI chatbot and GDPR: what matters when using it on your own website

As soon as users enter something into a AI chatbot , personal data is processed – at the latest when they provide their name, a callback number, or a specific request. Five points determine GDPR-compliant integration: transparency, data minimization, data processing agreement, processing location and the question of whether Inputs for training are used.

1. Transparency and labeling

Users must be able to recognize that they are communicating with an automated system – this follows from the GDPR transparency principle and from the labeling requirements for AI systems. In practice, a clear notice in the chat window is sufficient, supplemented by a link to the privacy information.

2. Data minimization: ideally do not collect them in the first place

The most effective data protection is not to collect data in the first place. A chatbot that answers general questions needs no name and no email address. Only when a request is actually to be passed on is a contact detail required – and then only the one needed to process it.

• No mandatory fields for data that are not needed for the response
• Define retention periods for conversation histories and delete them automatically
• Clearly separate general information from handing off a request

3. Data Processing Agreement

If the chatbot is operated via a service provider, a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is required, including the question of which sub-processors are involved. This applies in particular to the language model used.

4. Place of processing

Processing within the EUspares the additional requirements for third-country transfers. For models outside the EU, a valid transfer basis is required. This point should be clarified before selection, not afterwards — in practice, it is the strongest constraint on the choice of provider.

5. Are inputs used for training?

The point most often overlooked in data protection reviews. The contract should exclude the use of your website visitors’ inputs for the training of third-party models. Otherwise, content leaves the agreed purpose — with corresponding consequences for lawfulness.

Related to this is the question of the source of knowledge: a chatbot that responds exclusively from the company’s own documents is not only more reliable in terms of subject matter, but also easier to manage from a data protection perspective than one that draws freely from the internet.

Frequently asked questions about AI chatbots and the GDPR

Do I need consent for the chatbot?

For answering a question that users ask themselves, consent is usually not required. The situation is different if conversation histories are stored for the long term or combined with other data — this must be assessed separately.

Do I need to update the privacy policy?

Yes. Purpose, legal basis, recipients, retention period, and any transfer to a third country must be included in the privacy notice. This is one of the most common deficiencies in chatbots that have already been integrated.

May chat logs be stored?

For a limited period and with a clear purpose – for example, quality assurance – this is generally possible. A defined retention period and a functioning deletion concept are required.

What is the safest setup?

A chatbot that responds only from approved internal documents, collects as little data as possible, processes data within the EU, and whose inputs are contractually excluded from model training.

Next step

What a chatbot looks like that answers from your own documents is shown on the product page AI chatbot. The data protection-compliant introduction is eligible for 80% funding through INQA-Coaching.

As of September 2026. This article is intended as general guidance and does not replace legal advice in individual cases.