Nexly AgentsBlog

Nexly Agents › Blog › Guide

Guide

GDPR-compliant AI chatbot: a checklist for EU companies

Published 2026-10-14·6 min read·Author: Jakub Milewski, Nexly Lab

Photo: Unsplash

An AI chatbot processes personal data from the very first message. Customers type their name, an order number, an address, sometimes a national ID number nobody asked for. The GDPR does not forbid AI in customer service. It does change how you choose a vendor and how you configure the tool. Below are the questions worth going through before you sign. They do not replace your lawyer or data protection officer, but they will make that conversation shorter.

A data processing agreement, or DPA. The chatbot vendor processes your customers' data on your behalf, which makes it a processor under Article 28 of the GDPR. A controller may only use processors that provide sufficient guarantees. The contract must set out the subject matter and duration of processing, its nature and purpose, the type of personal data and the categories of data subjects. It must also oblige the vendor to act only on your documented instructions, including on transfers outside the EEA, to ensure confidentiality, to apply appropriate security, to help you handle data subject requests, and to delete or return the data when the service ends. A vendor without a DPA, or one that points you to general terms that say none of this, is your first warning sign.

Sub-processors. An AI chatbot is almost always a chain: the tool vendor, the language model provider, hosting, sometimes an analytics service. A processor may not engage another processor without your prior specific or general written authorisation. Under a general authorisation it must tell you about intended changes and give you the chance to object, and every sub-processor must carry the same obligations as the main vendor. Ask for a list with each company's name, role and processing location, and find out how you will hear about changes.

Transfers outside the EEA. If the language model runs on servers in the United States, data leaves the European Economic Area. Chapter V of the GDPR allows this with a legal basis. One option is an adequacy decision under Article 45, such as the Commission's decision of 10 July 2023 on the EU-US Data Privacy Framework, which covers only companies certified under that framework. Another is an appropriate safeguard under Article 46, most often standard contractual clauses. The question for the vendor is simple: where are conversations physically processed, by whom, and on what basis. Do not settle for a marketing line about "European data". What counts is what the DPA and the sub-processor list say.

Minimisation and masking. The data minimisation principle in Article 5 means the chatbot collects no more than it needs to answer. It does not ask for passwords, card numbers or ID numbers, and when a customer types them anyway, it does not copy them into other systems. Check whether personal data is masked in conversation reports and analytics, and whether technical logs are scrubbed. Article 25 requires data protection by design and by default, not as an afterthought.

Log retention. The storage limitation principle in the same Article 5 means data is kept only as long as the purpose requires. Agree separately how long conversation transcripts, technical logs and backups are kept, and whether the vendor deletes them automatically. "We keep it until you delete it" moves the whole problem back to you.

Model training on your data. Ask directly whether your customers' conversations are used to train or improve models, both by the tool vendor and by the model provider. This is a question about the purpose of processing: if data goes into training, the vendor is no longer acting only on your instructions. In Opinion 28/2024 of December 2024, the European Data Protection Board addressed, among other things, when a model trained on personal data can be considered anonymous and what follows from unlawful processing during development. The simplest position is a contract that rules out training on your data and a vendor that uses model APIs where submitted data is not used for training.

Telling the customer. Customers need to know two things. That their data is processed, who the controller is and for what purpose, as Article 13 of the GDPR requires; a short notice with a link to your privacy policy in the chat window does the job. And that they are talking to AI. Article 50(1) of the AI Act requires AI systems intended to interact directly with people to inform them of this, unless it is obvious. The obligation applies from 2 August 2026, and the information must be clear and given at the latest at the first interaction. Formally the duty sits with the system provider, but it is your brand the customer sees.

Data subject rights and impact assessment. Customers can ask for access to their data or for its deletion. Check that you can find and export one person's conversations. If the chatbot will handle special categories of data or process data at large scale, ask your data protection officer whether an impact assessment under Article 35 is needed.

The checklist in short:

  1. Will the vendor sign a DPA that meets Article 28?
  2. Do I have a sub-processor list with locations, and do I know how changes are announced?
  3. What is the legal basis for any transfer outside the EEA?
  4. Does the chatbot avoid asking for data it does not need?
  5. Is personal data masked in analytics and logs?
  6. How long are conversations and logs kept, and who deletes them?
  7. Does the contract rule out training models on my data?
  8. Does the customer see a privacy notice and know they are talking to AI?
  9. Can I find, export and delete one person's conversations?
  10. Has our DPO assessed whether an impact assessment is needed?

How Nexly Agents handles this: the agent runs on Nexly Lab infrastructure or self-hosted at the client. Processing is based on a DPA, and the processing location and sub-processors are set out in the data processing agreement. Personal data in conversation analytics is masked ([email], [phone], [address]); technical logs are scrubbed of e-mails and card numbers and deleted after 90 days. We use model APIs where submitted data is not used for training. The agent does not ask for passwords or card numbers, each company's data is separated, and every answer has a full trail (source, cost, time). Details are on our security page.

Want to see this on your own website rather than on slides? Enter your website address and e-mail in the demo form. In 20 minutes you get an agent trained on your offer, ready to be quizzed.

Sources

See the AI agent on your own website

Give us your website address and e-mail, and in 20 minutes you get an agent trained on your offer, ready to be quizzed.

Get a free demo

Read also

WhatsApp AI agent for customer service: how to set it up in 2026 Omnichannel AI customer service: one agent for website, email, WhatsApp, Teams and Slack Don't start AI with a revolution