AI Chatbot GDPR Compliance: Roles, Lawful Bases, and Rights Requests

AI chatbot GDPR compliance starts with a question most businesses skip: when a customer chats with your AI agent, whose personal data is it, and who is legally responsible for it? Under the GDPR, your business is usually the controller — you decide why customer data is processed — and the chatbot platform and messaging provider act as processors, handling data on your instructions. Getting those roles straight matters because the obligations split along them: the controller answers to customers and regulators, while processors must follow instructions, protect the data, and help the controller meet its duties.

This post is general information for small businesses, not legal advice; a regulated business or one handling sensitive data should have a lawyer review its setup. What follows is the practical shape of compliance, in the order a business actually builds it.

The lawful basis for answering customers

Every processing of personal data needs a lawful basis, and a service chatbot usually has a straightforward one: the customer messaged you asking for help, and answering them is necessary to provide the service they requested or to take steps toward a contract, such as a booking. That basis covers reading the message, retrieving the relevant documents, and replying. It does not cover everything the business might want to do with the conversation afterwards — analysing chats for marketing profiles, or reusing them to train a general model, needs its own basis and usually cannot ride on the service basis. Keep the purposes separate in your own records: service replies under one basis, any secondary use under its own, separately justified or not done at all.

Data-subject rights, as a workflow

Customers hold rights over their data — access, correction, deletion, restriction, and portability — and a chatbot makes those rights concrete: a customer who asks “delete everything you have on me” in chat is making a deletion request, and the business needs a path from that message to actual deletion across every system holding the conversation. Build the workflow before the request arrives: a named person who receives requests, a checklist of the systems to search (chat platform, chatbot dashboard, any connected CRM), and a confirmation reply to the customer once deletion is done. The same workflow covers access requests: export the customer's conversations and account data in a readable form, and note what you withheld and why if any part is exempt.

The DPA and your processors

• Sign a data processing agreement (DPA) with each processor — the chatbot platform and the messaging provider — covering what data is processed, for what purpose, with what security measures, and what happens at the end of the contract.
• Confirm sub-processors: a platform may rely on infrastructure or AI providers of its own. You are entitled to know who they are and to object to changes, so read the sub-processor list rather than assuming it.
• Check international transfers: if personal data leaves the European Economic Area, the transfer needs a lawful mechanism, such as an adequacy decision or standard contractual clauses in the DPA. Ask the vendor directly; “we use cloud servers” is not an answer.
• Agree deletion at exit: when you stop using a platform, its contract should say when your data is deleted and give you an export first. Exit deletion agreed in advance is worth more than an email asking for it later.

Where marketing consent begins

The line businesses cross most often is treating a service conversation as marketing permission. A customer who asked about delivery times has not consented to promotional messages, and consent for marketing must be freely given, specific, and withdrawable — a pre-ticked box or a buried clause does not meet that bar. On WhatsApp the line is doubly enforced: Meta's own template and opt-in rules sit on top of the GDPR, so a promotional message needs both genuine consent and an approved template. And a scope note: Neksio is not a bulk or broadcast tool, so a marketing-blast plan needs a different tool — and a lawful basis — before it needs software.

Owner: “A customer asked us to delete her chats, and we had no idea where they lived.” The chats were in three places and nobody owned the request. One checklist, one owner, one confirmation reply — that is the whole deletion workflow, and it takes an afternoon to build.

Records: the compliance file

Keep a short compliance file: the controller/processor map, the lawful basis for each purpose, the DPA copies, the sub-processor list, the retention periods you chose, and the log of rights requests handled. The file is not bureaucracy for its own sake — it is what you show a customer who asks how their data is handled, and what you rely on when a request or complaint arrives. Review it when you change platforms, add a channel, or start a new use of conversation data, because each change can quietly create a new obligation.