GDPR and AI agents: what to know before you put a bot on your website
25 October 2026 · 6 min read · Dennis BorsosA chatbot on your website or on WhatsApp seems like a small thing: a few automatic replies, a booking form, perhaps taking an order. But from the first message in which a customer types their name, phone number or a health problem, your bot is processing personal data. And that means GDPR.
The good news: a GDPR-compliant chatbot is no harder to build than a non-compliant one, as long as you think about data from the start. Below you will find what you need to know before you put a bot on your website, step by step, with a checklist at the end. This is not legal advice; for special cases, talk to a data protection specialist.
Why a chatbot falls under GDPR
The General Data Protection Regulation (Regulation (EU) 2016/679) applies to any processing of personal data, meaning any information about an identified or identifiable person. A bot almost always processes data of this kind:
- name, phone number, email, delivery address;
- the content of the conversation, which may include details about orders, problems and preferences;
- the phone number and the recording or transcript of a call, in the case of a voice agent;
- technical data: IP address, session identifiers, cookies.
As the business that decides why and how the data is used, you are the controller. The suppliers that process data on your behalf (the agency that builds the bot, the messaging platform, the AI model provider, the database) are processors. The main responsibility stays with you.
The six questions you need answers to
1. What is your lawful basis for processing the data?
Article 6 of the GDPR lists the lawful bases. For a customer service chatbot, the most common are:
- performance of a contract, or steps taken at the person’s request: the customer asks for an appointment or places an order;
- legitimate interests: for example, answering general questions or improving the service, provided your interest does not override the customer’s rights;
- consent: usually needed for marketing, newsletters or cookies that are not strictly necessary.
Decide the basis for each purpose separately. The fact that a customer asked for an appointment does not automatically give you the right to send them promotional offers.
2. Have you told people clearly?
Article 13 requires that, when you collect data, you say who you are, why you are collecting it, on what basis, who you share it with, how long you keep it and what rights the person has. In practice:
- the bot’s first message contains a short link to your privacy policy;
- the policy explicitly describes the bot: what data it collects, who the suppliers are, where it is stored;
- for a voice agent, the opening message says the call is being handled by a virtual assistant and, where relevant, that it is recorded or transcribed.
3. Are you collecting only what you need?
The data minimisation principle in Article 5 says you should ask only for the data needed for the purpose. For an appointment you need the name, phone number and time. You don’t need a national identification number or date of birth. Configure the bot not to ask for more than necessary and not to encourage customers to send documents or unnecessary details.
4. How long do you keep conversations?
Article 5 also requires that data is not kept longer than necessary. Set a specific retention period for conversations, transcripts and recordings, and build automatic deletion into the system rather than leaving it on the “some day” list.
5. Do you have contracts with all your suppliers?
Article 28 requires a written contract with every processor, setting out what they are allowed to do with the data. Make a list of every supplier involved in the bot (the agency, the database, the messaging or telephony platform, the voice provider, the AI model provider) and check the data processing agreement for each one.
6. Where does the data end up?
If data is transferred outside the European Economic Area, Chapter V of the GDPR requires appropriate safeguards. Many technology suppliers have infrastructure or parent companies outside the EU. Ask explicitly where the data is stored, where it is processed and on what basis it is transferred.
Situations where you need to be more careful
Health data and other special categories
Clinics, dental practices, salons that ask about allergies or conditions: if the bot collects information about health, you come under Article 9, which protects special categories of data and allows processing only under strict conditions. This deserves a dedicated assessment. A practical solution: the bot only takes the appointment, and medical details are kept for the conversation with the specialist.
Automated decisions
Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. A bot that books appointments doesn’t fall under this. One that automatically rejects a credit application or a job candidate may. Keep a person in the decision.
Impact assessment
Article 35 requires a data protection impact assessment where processing is likely to result in a high risk, especially when new technologies are used. For a simple information bot, this usually isn’t needed. For one that processes health data at scale or makes decisions about people, talk to a specialist about whether the assessment is mandatory.
Cookies and the chat widget
Many chat widgets place cookies or identifiers in the browser. In Romania, the rules on cookies come from Law no. 506/2004, in addition to the GDPR. Check whether your widget sets cookies that are not strictly necessary and, if it does, load it only after consent.
Security: the practical side
Article 32 requires technical and organisational measures appropriate to the risk. For a chatbot, that means at least:
- access to conversations only for the people who need it, with individual accounts;
- access keys and passwords kept securely, not in emails or shared documents;
- encrypted connections and a protected database, with row- and table-level access rules;
- backups and a plan for what you do if something goes wrong;
- the bot has no access to more data than it needs for its task.
Customer rights: how you respond
People have the right to find out what data you hold about them, to correct it, to ask for it to be erased and to object to certain processing. Make sure you can quickly find all of a person’s conversations by phone number or email and delete them on request. If the bot is built on a well-organised database, this takes minutes, not days.
What you risk
The authority that supervises GDPR enforcement in Romania is ANSPDCP. Article 83 of the GDPR provides for fines of up to €20 million or 4% of worldwide annual turnover for the most serious breaches. Beyond the fine, a leak of customer conversations directly damages your reputation.
Checklist before your bot goes live
- You have defined the purposes and the lawful basis for each one.
- Your privacy policy describes the bot and its suppliers.
- The first message says it is a virtual assistant and links to the privacy policy.
- The bot asks only for the data it needs.
- You have a retention period and automatic deletion.
- You have processing agreements with all suppliers.
- You know where the data is stored and processed and on what basis any transfers are made.
- You have checked whether you process health data or make automated decisions.
- The widget doesn’t set non-essential cookies without consent.
- You can quickly find and delete a person’s data.
- You have added the system to your record of processing activities, if your business has this obligation.
How we build
Our agents run on Claude, from Anthropic, and customer conversations and data are stored in Supabase, on servers in the EU. Every chatbot on WhatsApp or your website introduces itself as a virtual assistant, asks only for the data it needs and has access only to what it requires. The technical details are on our data security page. Remember that the AI Act also requires, separately from the GDPR, that people know they are talking to an AI.
If you want a bot that helps you with customers without creating data headaches, book a free 30-minute call. We will tell you honestly what data your bot would process and what needs to be in place before launch.
Frequently asked questions
Is it legal to use a chatbot on my website?
Yes, as long as you comply with the GDPR. That means a lawful basis for each purpose, informing people clearly, collecting only the data you need, a defined retention period, contracts with your suppliers and security measures. Separately, the AI Act requires that people know they are talking to an AI system.
Do I need consent to use a chatbot?
Not always. If the bot takes an appointment or an order the customer asked for, the basis can be performance of a contract or steps taken at the person’s request. For marketing, newsletters or cookies that are not strictly necessary, you usually need consent. Set the basis separately for each purpose and record it in your internal documentation.
How long can I keep chatbot conversations?
The GDPR doesn’t give a fixed number of days. It requires that data is kept only as long as necessary for the purpose it was collected for. Set a justified period yourself, for example the time it takes to resolve the request plus a reasonable margin, state it in your privacy policy and configure automatic deletion.
What should I do if the bot receives health data?
Health data is a special category, protected by Article 9 of the GDPR, and can only be processed under strict conditions. The safest option is for the bot to take only the appointment, with no medical details, and to avoid questions about conditions. If you do need this kind of data, ask a specialist for a dedicated assessment.
Who is responsible if the bot supplier loses data?
As the controller, you remain responsible to your customers and to the authority. The supplier, as a processor, has its own obligations under the processing agreement and the GDPR. That is why it matters to have written contracts with all suppliers, to know where the data is stored and to choose partners who can explain their security measures to you.
Related articles
Prefer to talk directly?
We reply the same business day. Choose whatever suits you best.
GDPR and AI agents: what to know before you put a bot on your website
25 October 2026 · 6 min read · Dennis BorsosA chatbot on your website or on WhatsApp seems like a small thing: a few automatic replies, a booking form, perhaps taking an order. But from the first message in which a customer types their name, phone number or a health problem, your bot is processing personal data. And that means GDPR.
The good news: a GDPR-compliant chatbot is no harder to build than a non-compliant one, as long as you think about data from the start. Below you will find what you need to know before you put a bot on your website, step by step, with a checklist at the end. This is not legal advice; for special cases, talk to a data protection specialist.
Why a chatbot falls under GDPR
The General Data Protection Regulation (Regulation (EU) 2016/679) applies to any processing of personal data, meaning any information about an identified or identifiable person. A bot almost always processes data of this kind:
- name, phone number, email, delivery address;
- the content of the conversation, which may include details about orders, problems and preferences;
- the phone number and the recording or transcript of a call, in the case of a voice agent;
- technical data: IP address, session identifiers, cookies.
As the business that decides why and how the data is used, you are the controller. The suppliers that process data on your behalf (the agency that builds the bot, the messaging platform, the AI model provider, the database) are processors. The main responsibility stays with you.
The six questions you need answers to
1. What is your lawful basis for processing the data?
Article 6 of the GDPR lists the lawful bases. For a customer service chatbot, the most common are:
- performance of a contract, or steps taken at the person’s request: the customer asks for an appointment or places an order;
- legitimate interests: for example, answering general questions or improving the service, provided your interest does not override the customer’s rights;
- consent: usually needed for marketing, newsletters or cookies that are not strictly necessary.
Decide the basis for each purpose separately. The fact that a customer asked for an appointment does not automatically give you the right to send them promotional offers.
2. Have you told people clearly?
Article 13 requires that, when you collect data, you say who you are, why you are collecting it, on what basis, who you share it with, how long you keep it and what rights the person has. In practice:
- the bot’s first message contains a short link to your privacy policy;
- the policy explicitly describes the bot: what data it collects, who the suppliers are, where it is stored;
- for a voice agent, the opening message says the call is being handled by a virtual assistant and, where relevant, that it is recorded or transcribed.
3. Are you collecting only what you need?
The data minimisation principle in Article 5 says you should ask only for the data needed for the purpose. For an appointment you need the name, phone number and time. You don’t need a national identification number or date of birth. Configure the bot not to ask for more than necessary and not to encourage customers to send documents or unnecessary details.
4. How long do you keep conversations?
Article 5 also requires that data is not kept longer than necessary. Set a specific retention period for conversations, transcripts and recordings, and build automatic deletion into the system rather than leaving it on the “some day” list.
5. Do you have contracts with all your suppliers?
Article 28 requires a written contract with every processor, setting out what they are allowed to do with the data. Make a list of every supplier involved in the bot (the agency, the database, the messaging or telephony platform, the voice provider, the AI model provider) and check the data processing agreement for each one.
6. Where does the data end up?
If data is transferred outside the European Economic Area, Chapter V of the GDPR requires appropriate safeguards. Many technology suppliers have infrastructure or parent companies outside the EU. Ask explicitly where the data is stored, where it is processed and on what basis it is transferred.
Situations where you need to be more careful
Health data and other special categories
Clinics, dental practices, salons that ask about allergies or conditions: if the bot collects information about health, you come under Article 9, which protects special categories of data and allows processing only under strict conditions. This deserves a dedicated assessment. A practical solution: the bot only takes the appointment, and medical details are kept for the conversation with the specialist.
Automated decisions
Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. A bot that books appointments doesn’t fall under this. One that automatically rejects a credit application or a job candidate may. Keep a person in the decision.
Impact assessment
Article 35 requires a data protection impact assessment where processing is likely to result in a high risk, especially when new technologies are used. For a simple information bot, this usually isn’t needed. For one that processes health data at scale or makes decisions about people, talk to a specialist about whether the assessment is mandatory.
Cookies and the chat widget
Many chat widgets place cookies or identifiers in the browser. In Romania, the rules on cookies come from Law no. 506/2004, in addition to the GDPR. Check whether your widget sets cookies that are not strictly necessary and, if it does, load it only after consent.
Security: the practical side
Article 32 requires technical and organisational measures appropriate to the risk. For a chatbot, that means at least:
- access to conversations only for the people who need it, with individual accounts;
- access keys and passwords kept securely, not in emails or shared documents;
- encrypted connections and a protected database, with row- and table-level access rules;
- backups and a plan for what you do if something goes wrong;
- the bot has no access to more data than it needs for its task.
Customer rights: how you respond
People have the right to find out what data you hold about them, to correct it, to ask for it to be erased and to object to certain processing. Make sure you can quickly find all of a person’s conversations by phone number or email and delete them on request. If the bot is built on a well-organised database, this takes minutes, not days.
What you risk
The authority that supervises GDPR enforcement in Romania is ANSPDCP. Article 83 of the GDPR provides for fines of up to €20 million or 4% of worldwide annual turnover for the most serious breaches. Beyond the fine, a leak of customer conversations directly damages your reputation.
Checklist before your bot goes live
- You have defined the purposes and the lawful basis for each one.
- Your privacy policy describes the bot and its suppliers.
- The first message says it is a virtual assistant and links to the privacy policy.
- The bot asks only for the data it needs.
- You have a retention period and automatic deletion.
- You have processing agreements with all suppliers.
- You know where the data is stored and processed and on what basis any transfers are made.
- You have checked whether you process health data or make automated decisions.
- The widget doesn’t set non-essential cookies without consent.
- You can quickly find and delete a person’s data.
- You have added the system to your record of processing activities, if your business has this obligation.
How we build
Our agents run on Claude, from Anthropic, and customer conversations and data are stored in Supabase, on servers in the EU. Every chatbot on WhatsApp or your website introduces itself as a virtual assistant, asks only for the data it needs and has access only to what it requires. The technical details are on our data security page. Remember that the AI Act also requires, separately from the GDPR, that people know they are talking to an AI.
If you want a bot that helps you with customers without creating data headaches, book a free 30-minute call. We will tell you honestly what data your bot would process and what needs to be in place before launch.
Frequently asked questions
Is it legal to use a chatbot on my website?
Yes, as long as you comply with the GDPR. That means a lawful basis for each purpose, informing people clearly, collecting only the data you need, a defined retention period, contracts with your suppliers and security measures. Separately, the AI Act requires that people know they are talking to an AI system.
Do I need consent to use a chatbot?
Not always. If the bot takes an appointment or an order the customer asked for, the basis can be performance of a contract or steps taken at the person’s request. For marketing, newsletters or cookies that are not strictly necessary, you usually need consent. Set the basis separately for each purpose and record it in your internal documentation.
How long can I keep chatbot conversations?
The GDPR doesn’t give a fixed number of days. It requires that data is kept only as long as necessary for the purpose it was collected for. Set a justified period yourself, for example the time it takes to resolve the request plus a reasonable margin, state it in your privacy policy and configure automatic deletion.
What should I do if the bot receives health data?
Health data is a special category, protected by Article 9 of the GDPR, and can only be processed under strict conditions. The safest option is for the bot to take only the appointment, with no medical details, and to avoid questions about conditions. If you do need this kind of data, ask a specialist for a dedicated assessment.
Who is responsible if the bot supplier loses data?
As the controller, you remain responsible to your customers and to the authority. The supplier, as a processor, has its own obligations under the processing agreement and the GDPR. That is why it matters to have written contracts with all suppliers, to know where the data is stored and to choose partners who can explain their security measures to you.
Related articles
Prefer to talk directly?
We reply the same business day. Choose whatever suits you best.
