GDPR and AI Chatbots: What Businesses Need to Know

What Personal Data Does an AI Chatbot Process?

As soon as a user interacts with an AI chatbot, data is generated. The most obvious data is the content of the conversation itself: text input, questions, complaints, booking details. In many cases, this conversation data is personal data within the meaning of the GDPR — either because it contains direct identifiers such as names or email addresses, or because it can be attributed to a person in combination with other available data. IP addresses, which are technically transmitted during web chat, are also considered personal data.

For chatbots used in the context of customer account processes, additional data categories are added: customer numbers, order histories, payment information (if the chatbot is integrated into checkout processes), or health data (in medical applications). These special categories under Art. 9 GDPR are subject to a heightened level of protection and require special technical and legal safeguards.

The principle of data minimization (Art. 5(1)(c) GDPR) requires that only data actually necessary for the respective purpose be processed. For a pure FAQ chatbot without authentication, this means: conversation content should not be permanently stored, IP addresses should be anonymized, and personal details should only be collected if they are strictly necessary for the service process. A carefully configured chatbot is therefore considerably less problematic from a data protection perspective than a poorly planned one.

GDPR Requirements for Chatbot Operations

The GDPR sets out a number of basic requirements for every processing operation. First, every data processing activity needs a legal basis under Art. 6 GDPR: either the user's consent, necessity for a contract, a legitimate interest of the business, or another of the grounds named in the law. The legal basis must be determined and documented before processing takes place — and must be justifiable to the data protection authority if necessary.

Second, there is a comprehensive obligation to inform data subjects. Users must know what data is processed for what purpose, how long it is retained, who the recipients may be, and what rights they have — including the right of access, rectification, erasure, and restriction of processing. This information must be accessible in clear, understandable language, typically in the privacy policy and via a notice in the chat window.

Third, the GDPR mandates the principle of "privacy by design and by default" (Art. 25). This means that privacy-friendly configurations are the default from the outset, not subsequent additions. For AI chatbots, this means in practice: shorter retention periods as the standard, anonymization of log data, restrictive access permissions, and an easy way for users to have their data deleted.

Cloud AI vs. On-Premises: What Does This Mean for Data Protection?

With a cloud-based AI chatbot, conversation data and requests are sent to external servers of a language model provider, processed there, and — depending on configuration — potentially used for training purposes. What matters for GDPR assessment is: in which country are the servers located? For US-based providers, the legal situation has been complex since the Schrems II ruling. EU providers or those with EU data centers are clearly preferable under European data protection law. In addition, a data processing agreement (DPA) must be concluded.

On-premises means that the entire infrastructure — including the AI model — runs on servers controlled by the company itself. With local AI execution, no conversation data leaves the company's own infrastructure. This completely eliminates the need for a DPA with a cloud AI provider; processing takes place exclusively internally. For companies in regulated industries — healthcare, legal services, financial services — on-premises is often the only viable option.

A hybrid approach is also possible: the chatbot infrastructure and knowledge base run on secure servers within the EU, while a cloud model is used for certain, less sensitive use cases. Zentor App supports both operating modes — cloud via an external AI provider as well as fully local — and lets companies decide for themselves which architecture fits their data protection strategy. The decision should ideally be made together with the data protection officer and a data protection lawyer.

Data Processing Agreement (DPA): When It's Required and What It Governs

The data processing agreement (DPA) under Art. 28 GDPR is the central instrument for legally regulating the responsibilities between a company (controller) and an external service provider (processor) that processes personal data on its behalf. When operating an AI chatbot via a SaaS platform, a DPA is generally mandatory: the chatbot provider processes conversation data on its servers — this is classic data processing on behalf of a controller.

A DPA must be concluded in writing or in an equivalent electronic format and must cover a number of minimum content requirements: the subject matter and duration of the processing, the nature and purpose of the processing, the categories of personal data and data subjects, as well as the obligations and rights of the controller. In addition, the processor must guarantee that it implements appropriate technical and organizational measures (TOMs) and does not engage sub-processors without authorization.

Important: the DPA must be concluded before the chatbot goes live — not retroactively. A missing DPA despite ongoing processing on behalf of a controller is a standalone GDPR violation subject to fines. Therefore, check with every chatbot provider whether and in what form a DPA is offered, which sub-processors are used (e.g., cloud providers or external AI providers), and how this is handled. Reputable providers such as Zentor App provide standardized DPA templates and are willing to disclose their content transparently.

Data Protection Officer and Chatbots: What to Consider

Companies that have an internal or external data protection officer (DPO) must involve them when introducing an AI chatbot. The DPO's task is to ensure a data-protection-compliant implementation, assess risks, and monitor GDPR compliance. This is not just about formal compliance, but about the concrete technical configuration: What data is stored? For how long? Who has access? How are data subject access requests handled?

One of the DPO's most important tasks in the chatbot context is checking whether a data protection impact assessment (DPIA) under Art. 35 GDPR is required. A DPIA is mandatory when the data processing is likely to result in a high risk to the rights and freedoms of natural persons. This can be the case with a chatbot if sensitive data is processed systematically, profiling takes place, or the system is used for decisions that have significant effects on data subjects.

Even if a DPO is not legally required, a data protection review before go-live is advisable. Especially for smaller companies deploying a chatbot for the first time, typical pitfalls lurk: a missing or outdated privacy policy, a forgotten DPA, excessively long retention periods, or missing deletion concepts. External advice from a data protection expert pays off in the long run here and protects against significant fines that data protection authorities can impose.

Technical and Organizational Measures (TOMs) for Chatbots

Art. 32 of the GDPR requires appropriate technical and organizational measures (TOMs) to ensure a level of protection appropriate to the risk. For AI chatbots, this specifically means: all data transmissions between the user's browser and the chatbot backend must be encrypted (TLS/HTTPS). Stored conversation data and knowledge base content should also be stored encrypted — both in the database and on the associated storage media.

On the access side, the GDPR mandates the principle of access restriction: only those employees and systems that actually need it for their work may access personal data. Zentor App implements this principle with a role-based access control (RBAC) system, available as a freely selectable module in the Individual package: different roles receive different access rights, and all access is logged in an audit trail. This makes it possible, if necessary, to prove who accessed which data and when.

Organizationally, TOMs include clear internal processes: Who is responsible for the knowledge base? How are deletion requests from data subjects handled? How is it ensured that no conversation data is stored longer than necessary? How does the company respond in the event of a data breach — for example, if a chatbot inadvertently discloses another user's personal data? These processes must be documented in writing and reviewed regularly.

Zentor App and GDPR: EU Hosting and On-Premises as Options

Zentor App was designed from the outset to enable GDPR-compliant operation. The platform can be hosted on EU servers — hosting, databases, and application logic are then subject to European data protection law. If an external AI provider is optionally connected, any use outside the EU takes place exclusively under EU Standard Contractual Clauses (Art. 46 GDPR) — eliminating the legal uncertainty of an uncontrolled third-country transfer. For companies considering a cloud-based solution, EU hosting is the first and most important step towards GDPR compliance.

For companies with the highest data protection requirements, Zentor App offers a fully on-premises installation. In this operating mode, the entire platform — chatbot engine, knowledge base, omnichannel inbox, and all processing components — runs on infrastructure controlled by the company itself. With local AI execution, no conversation data and no personal information leaves the company's own IT environment. This approach is particularly suitable for hospitals, law firms, tax consultancies, and other industries where data protection is existential.

Zentor App provides data processing agreements (DPAs) for cloud operation and documents the sub-processors used — with company name, country, purpose, and transfer basis — in section 13 of the privacy policy. The technical data protection features — RBAC, audit trail, configurable data retention periods, and role-based access controls — are configurable as freely selectable modules in the Individual package. This creates the technical prerequisites for GDPR-compliant chatbot operation — the legal structuring in the specific individual case always remains the responsibility of your data protection team and legal advisors.

Frequently Asked Questions