An AI chatbot may process names, contact details, conversation content, and service requests. Choosing the interface is only one part of the decision; the business also needs to understand the data flow behind it.

This checklist is general information, not legal advice.

1. Map the data journey

Identify what the chatbot collects, where it is sent, which providers process it, where it is stored, and which integrations receive a copy. Ask for documentation rather than relying on a generic "GDPR compliant" label.

2. Minimise collection

Do not request identity, address, health, or payment information simply because the chatbot can. Each field should have a defined purpose and legal basis.

3. Make automation transparent

Tell users they are interacting with an automated assistant. Provide a clear privacy notice and explain when their information will be passed to staff or another system.

4. Review security and access

Evaluate authentication, role-based access, transport and storage protections, logging, backups, incident processes, and how provider personnel access customer data.

5. Plan retention and rights requests

The business needs a workable process for access, correction, deletion, objection, and retention. Check whether records can be located and handled across both the chatbot and connected systems.

6. Document responsibilities

Confirm the controller/processor roles, data-processing terms, subprocessors, and international transfer mechanism where relevant.

A privacy-aware chatbot is the result of product controls and responsible configuration. Read more about GDPR in customer communication and review the privacy policy.