An AI chatbot is quickly embedded on a website – but it processes personal data , often via an external, sometimes US-based service. That is exactly what turns the convenient widget into a liability risk, and from 2 August 2026 into a double one: GDPR-compliant data processing and labelling under the EU AI Act must both be in place. This article shows the complete build of a legally sound chatbot – five GDPR duties plus the AI notice.
As of 26 July 2026. This article is not legal advice. The concrete design – legal basis, data processing agreement, deletion periods – should be reviewed for your individual case by your data protection officer or a lawyer.
The 5-point GDPR checklist for chatbots
In data protection terms, a chatbot is not a special case but a data processing operation like any other – only in real time and often with a third-party provider in the background. Five core duties make it compliant.
1. Legal basis: legitimate interest or consent (Art. 6)
Every processing needs a legal basis. For the pure support operation of a chatbot, legitimate interest (Art. 6(1)(f)) is usually a candidate. As soon as you process data beyond what is necessary, or load external scripts that themselves transfer data, consent (point (a)) is the clean route. It must be freely given, informed and unambiguous – a consent gate that starts the chatbot only after active agreement implements this correctly.
2. Information duty (Art. 13) & privacy policy
Users must know what happens to their input: who processes it, for what purpose, on what basis, for how long, and whether data flows to a third country. This belongs in the privacy policy, with a dedicated chatbot section – clearly linked from the chat window.
3. Data processing agreement (Art. 28) with the AI provider
If an external AI or chatbot service processes personal user input on your behalf, a data processing agreement (DPA) under Art. 28 GDPR is required. Without it, you process without a valid basis – a frequent, costly mistake with quickly embedded cheap widgets. Important qualification: the DPA is needed precisely when personal data is actually processed on your behalf – not as a blanket rule for every technical tool.
4. EU hosting, data minimisation & deletion concept
Where the processing takes place determines the effort: a provider with a data centre in the EU spares you the complex safeguarding of third-country transfers. Data minimisation is mandatory – the bot should only collect what it needs for the answer. And every processing needs a deletion concept: clear periods after which conversations are deleted, rather than storing them indefinitely.
| Duty | Provision | Concrete implementation |
|---|---|---|
| Legal basis | Art. 6 GDPR | Legitimate interest or consent via a consent gate |
| Information | Art. 13 GDPR | Chatbot section in the privacy policy, linked |
| Data processing | Art. 28 GDPR | Conclude a DPA with the AI provider |
| Hosting & deletion | Art. 5 GDPR | EU data centre, data minimisation, deletion periods |
| AI labelling | Art. 50 EU AI Act | Visible notice before interaction from 2 Aug 2026 |
GDPR & AI Act chatbot checklist – duty, provision, implementation
Labelling under Art. 50 – concretely at the chat window
From 2 August 2026, the bot must additionally be recognisable as AI – as required by the transparency obligation under Art. 50. In practice: a clear opening bot message plus a static label on the chat window – not just a sentence in the privacy policy. What else needs labelling at the website level – such as AI-generated content and deepfakes – is covered in detail in the article on AI Act obligations for websites .
Connecting company knowledge safely: RAG instead of copy-paste
A useful chatbot knows your company knowledge. The safe route there is RAG (Retrieval-Augmented Generation): the bot accesses approved documents in a controlled way instead of feeding your data into model training. An important honesty: RAG is not automatically GDPR-safe – only in combination with EU hosting and a zero-data-retention agreement (the provider does not store the inputs) do company and customer data stay in your hands.
Embedding a widget vs. building your own – the liability question
A ready-made widget is embedded in minutes – but the data protection responsibility stays with the operator, not the provider. "My provider says it's GDPR-compliant" does not relieve you: you must check the DPA, hosting location and deletion concept yourself. A self-built or custom chatbot with EU hosting, a clean legal basis and a built-in transparency notice costs more to develop, but does not push the legal risk back onto you.
The most common costly mistake: a US chatbot widget without a data processing agreement and without EU hosting, embedded without a consent gate. Then the legal basis is missing – and from 2 August 2026 the AI labelling as well.
In short
- Five core GDPR duties: legal basis (Art. 6), information (Art. 13), DPA (Art. 28), EU hosting, deletion concept.
- A DPA only when personal data is actually processed on your behalf – not as a blanket rule.
- From 2 Aug 2026, additionally the visible AI notice under Art. 50.
- RAG connects company knowledge in a controlled way – GDPR-safe only with EU hosting and zero data retention.
- Responsibility stays with the operator: widget convenience does not replace a clean architecture.
