GDPR for Conversational AI: What Businesses Must Do

The GDPR applies to a chatbot or conversational AI agent whenever it processes personal data of people in the EU, and a company based in the US is covered if it offers goods or services to those people or monitors their behavior. In practice that means a customer-service agent needs a lawful basis, clear disclosure, limited data collection, defined retention, security, a route for data-subject rights, and evidence that it behaves as designed. This guide sets out each obligation and shows how to verify it in production.

TL;DR

• The GDPR follows the people, not the server: a US company that offers services to people in the EU or monitors their behavior falls within scope.
• A chat transcript usually contains personal data. The business deploying the agent is typically the controller, and the AI vendor is a processor or, for its own purposes, a separate controller.
• A lawful basis, a visible privacy notice, data minimization, limited retention and working data-subject rights are the core requirements.
• High-risk or automated decision-making deployments call for a data protection impact assessment (DPIA) and meaningful human oversight, including a reliable handoff to a person.
• Compliance on paper is not evidence. Independent testing of live agent behavior is what shows that the controls work.

Table of Contents

• When the GDPR applies to a chatbot
• Is a conversation personal data?
• Controller, processor and the AI provider
• Lawful basis and what users must be told
• Data minimization, retention and security
• DPIAs, automated decisions and human oversight
• How the AI Act sits alongside the GDPR
• Monitoring and auditing agents in production
• Perspective: assurance has to be independent
• A practical checklist before launch
• Testing and monitoring with Lexic
• FAQ
• Sources

When the GDPR applies to a chatbot

Scope is the first question for any company outside Europe. According to the European Commission, the GDPR covers an entity that processes personal data in the context of an EU-established branch, wherever the processing takes place. It also covers a company established outside the EU that offers goods or services to individuals in the EU, or monitors their behavior.

For a conversational AI agent, three situations are common:

• An EU branch or subsidiary runs the agent. The GDPR applies to the processing carried out in the context of that establishment.
• A US company serves EU customers. A support chatbot on a site that sells to, or targets, people in EU member states is an offering to individuals in the EU.
• An agent tracks behavior. A sales assistant that profiles visitors in the EU, scores intent or logs browsing behavior is monitoring behavior.

A chatbot that is only reachable by people in the US, with no offering to the EU, is outside this test. Most customer-facing agents on public websites are not that narrow. Teams entering Europe should assume the GDPR applies and work backward from there.

Is a conversation personal data?

In most customer-service deployments, yes. Users type names, email addresses, order numbers, account details, health or financial circumstances and complaints. Voice agents add recordings and, often, voice characteristics. Even when a user gives no name, the combination of details and session identifiers can single out a person. The safe operating assumption is that transcripts, logs, analytics events and any data passed to a model are personal data until a specific analysis proves otherwise.

This includes data a customer volunteers unprompted. An agent built to answer shipping questions will still receive a diagnosis, a home address or a complaint about a colleague. Design for what users will type, not for what the script expects.

Controller, processor and the AI provider

The GDPR assigns responsibility by role, and the role determines who answers to a regulator and a customer.

The business that decides why and how the chatbot processes personal data is the controller. Provider documentation reflects this. For its site-building product, OpenAI states that the site operator is the controller of personal data collected through the site, while OpenAI processes it as needed to provide and operate the site.

The provider can also hold a second role. As law firm Schjødt notes, an AI service provider may act as a controller for its own purposes, such as training its models on user-provided data, while the business using the service remains responsible for how personal data is processed through its AI tool.

This split has practical consequences:

1. Sign a data processing agreement with every vendor in the chain: the model provider, the chatbot platform, the telephony or messaging layer and the analytics tool.
2. Check whether the vendor uses conversations to train models. If it does, that is a separate purpose that needs its own justification and disclosure, or it needs to be switched off by contract and configuration.
3. Map sub-processors and transfers. US companies receiving EU data, and EU companies sending it to US providers, need a documented transfer mechanism.
4. Keep the controller accountable. Outsourcing the technology does not outsource the obligation. If the vendor’s agent misbehaves, the deploying business still answers to the customer and the regulator.

Lawful basis and what users must be told

Every processing purpose needs a lawful basis. For chatbots, the realistic candidates are:

• Contract, when the agent handles a request that is necessary to deliver what the customer ordered, such as a delivery change.
• Legitimate interests, for purposes such as service quality or fraud prevention, supported by a documented balancing test.
• Consent, for optional uses such as marketing follow-up, non-essential cookies on the chat widget or using transcripts for purposes beyond the service.

OpenAI’s own guidance for site operators says that in some cases organizations should ask for opt-in consent and should publish a visible privacy policy explaining what data is collected, how it is used and how people can control it.

The legitimate-interests test has three parts: a legitimate purpose, necessity and a balance against the rights of the individual. The European Data Protection Board applies exactly that structure in its guidelines on web scraping for generative AI. The same discipline applies to chat data: write the purpose down, show the processing is necessary, and record why customers’ rights do not override it.

For disclosure, the chat window is the place to start. A short notice at the start of the conversation should say that the user is talking to an AI agent, what the conversation is used for and where the full privacy notice sits. The full notice should cover categories of data, purposes, recipients, retention periods, transfers and rights.

Data minimization, retention and security

The Irish Data Protection Commission summarizes the baseline for organizations using AI tools: collect only what is necessary, do not keep it longer than needed, apply appropriate security and make it possible to exercise rights of access, correction and deletion. OpenAI’s guidance for site operators repeats the minimization principle: collect only the personal data the site needs to work, and do not hold it longer than necessary.

Turned into controls for a conversational agent:

The same security duty extends beyond the chatbot itself. The OpenAI guidance says organizations should apply appropriate security measures to the site and to any other system where they store information collected through it. Transcripts copied into a ticketing system or a data warehouse are in scope.

Public availability does not remove protection. The EDPB’s ChatGPT taskforce report states that publicly accessible personal data stays within the GDPR and that AI development using it still requires a lawful basis and compliance with data-protection requirements. For deployers, the point is to ask vendors what data their models were built on.

The Irish DPC adds a question worth asking before any build: whether a non-AI approach could reach the same purpose with less risk. A simple structured form is sometimes the better answer for a narrow task.

DPIAs, automated decisions and human oversight

Many chatbot projects need a data protection impact assessment. The UK Information Commissioner’s Office (ICO) states in its AI auditing framework guidance that using AI to process personal data is likely to result in a high risk to individuals’ rights and freedoms, which triggers the legal requirement for a DPIA. The ICO is a UK authority and its guidance is not EU law, but it applies the same GDPR principles and is a practical reference for the method.

The ICO’s governance and accountability toolkit gives the sequence: complete the DPIA before processing starts, assess the impact of automated decision-making and put appropriate safeguards in place. It also says the DPIA should begin at the earliest stage of development and include a systematic description of the processing, the data flows and an assessment of human involvement.

A workable DPIA for a customer-service agent covers:

1. The purposes and the categories of data the agent will see, including data users volunteer.
2. The data flow from the chat widget to the model, the platform, logs and downstream systems.
3. The risks to customers: wrong or invented answers, disclosure of another customer’s data, unfair outcomes, inability to reach a person.
4. The mitigations: scope limits, filters, escalation rules, testing and monitoring.
5. The sign-off, the owner and the review date.

Why human review matters

If an agent’s output feeds a decision that significantly affects a person, such as refusing a refund, closing an account or denying a claim, automated decision-making rules come into play. The Irish DPC warns that relying on AI outputs without critical human analysis or intervention can introduce automated decision-making risks. A European Parliament resolution on AI in a digital age states that systems posing high risks to fundamental and human rights require full human oversight and regulatory intervention. It also points to automation bias, where people rely too heavily on machine output.

For a support agent, human oversight has a concrete form: the escalation path. The agent must recognize when to hand over, do it reliably, and pass context so the customer does not repeat everything. This is where deployments most often fail. In Lexic’s audits, 85% of the agents assessed did not escalate issues to a human representative appropriately. A policy that promises a human route does not help a customer whose agent keeps looping.

How the AI Act sits alongside the GDPR

The EU AI Act (Regulation 2024/1689) sets harmonized rules for AI systems and complements EU data-protection law, which continues to apply whenever an AI system processes personal data. The two regimes do not replace each other. The GDPR asks whether personal data is handled lawfully and fairly. The AI Act adds obligations tied to the AI system itself, such as transparency, risk management and oversight, with requirements that depend on the system’s risk category.

For US companies entering Europe, the practical reading is to build one control set. A single register of AI agents, one DPIA process that also captures AI Act risk questions, and one evidence trail serve both regimes. Check the official text for the obligations and application dates that apply to your category of system, because phase-in schedules differ by provision.

Monitoring and auditing agents in production

A DPIA describes intended behavior. An audit shows actual behavior. The ICO’s governance toolkit recommends risk-based audit programs that assess AI-system compliance periodically, with audit reports shared with senior management.

For conversational agents, a useful audit tests the agent the way a customer meets it. Questions to answer with evidence:

• Does the agent disclose that it is an AI, and does it do so consistently?
• Does it escalate to a person when a customer asks, or when the situation requires it?
• Can it be talked into revealing personal data, internal instructions or another customer’s information?
• Does it ask for more personal data than the task requires?
• Does it give wrong or invented statements about rights, refunds or policies?
• Does it behave the same way after a model update, a prompt change or a vendor release?

Vendor dashboards usually report what the vendor chooses to measure. Independent testing complements them because it checks the outcome from outside, across vendors, and produces records that stand up in a dispute with the provider or a regulator.

Perspective: assurance has to be independent

We audit conversational AI agents from any vendor by interacting with them as real users would. Across customer experience, security, technical reliability and regulatory compliance, the same pattern recurs: the documented design and the live behavior diverge. The 85% escalation failure rate in our audits is the clearest example. Organizations had the policy, the vendor had the feature, and the customer still could not reach a person.

GDPR compliance for conversational AI therefore depends on three habits. First, treat each agent as a governed system with an owner, a DPIA and a review cycle. Second, test behavior continuously, because prompts, models and knowledge bases change. Third, keep evidence that cannot be disputed later. That is why we apply third-party cryptographic hashing to audit evidence, so its integrity can be verified and traced.

The agent is a vendor’s product, but the customer relationship and the legal responsibility belong to the deploying business. Independent evidence is how that business keeps control as deployments scale.

— Sergio Llorens

A practical checklist before launch

Use this list before an agent goes live in an EU-facing flow, and again after any major change.

1. Scope: record why the GDPR applies and which markets the agent serves.
2. Roles: document the controller and processor relationships and sign the data processing agreements.
3. Training use: confirm in writing whether the vendor uses your conversations to improve its models.
4. Lawful basis: assign a basis to each purpose, and keep the balancing test for legitimate interests.
5. Notice: show an AI disclosure and a privacy link inside the chat.
6. Minimization: cut every data field the task does not need.
7. Retention: set deletion periods for transcripts, recordings and copies.
8. Rights: test an access request and a deletion request end to end.
9. DPIA: complete it before launch and name an owner.
10. Escalation: test the human handoff with realistic edge cases.
11. Security: run adversarial tests for data leakage and prompt injection.
12. Evidence: schedule recurring independent audits and store the reports.

Testing and monitoring with Lexic

Lexic Compass is our AI agent audit platform. It assesses conversational agents from any vendor through real-world interactions and reports on customer experience, security, technical reliability and regulatory compliance, including issues traditional monitoring can miss. Engagements range from a Flash Preview and an Audit Sprint to Enterprise Continuous Trust, described on the audit engagement page. For analysis of every customer conversation across calls, chats, emails and tickets, Lexic Pulse turns interactions into sentiment, churn and opportunity insight.

To see where your agents stand before a regulator or customer asks, start at lexic.ai.

FAQ

Does a US company need to comply with the GDPR for its chatbot?

Yes, if the chatbot is part of offering goods or services to people in the EU, or monitors their behavior. The European Commission describes these as the tests for companies established outside the EU. A chatbot on a US-only service with no EU offering is outside that test.

Do chatbot conversations count as personal data?

Usually they do, because users share names, contact details, account information and personal circumstances. Logs and session identifiers can also identify a person. Treat transcripts as personal data unless a documented assessment shows otherwise.

What legal basis can a chatbot rely on?

The common bases are contract, legitimate interests and consent, depending on the purpose. Service delivery often fits contract or legitimate interests, while optional uses such as marketing or extra analytics often need opt-in consent. Each purpose needs its own basis and a visible privacy notice.

Is a DPIA required for an AI chatbot?

Often. The ICO’s guidance says that using AI to process personal data is likely to result in high risk, which triggers a DPIA. Complete it before launch and revisit it when the agent, the model or the data changes.

How does the AI Act affect GDPR obligations?

The AI Act complements the GDPR and does not replace it. The GDPR continues to apply whenever an AI system processes personal data, and the AI Act adds obligations that depend on the system’s risk category.

Sources

• Application of the GDPR, European Commission
• Complying with data protection laws for ChatGPT Sites, OpenAI Help Center
• A brief look at privacy and generative AI, Schjødt
• AI, Large Language Models and Data Protection, Irish Data Protection Commission
• Guidelines 03/2026 on web scraping, European Data Protection Board
• Report of the ChatGPT taskforce, European Data Protection Board
• Governance and accountability in AI, ICO
• Guidance on the AI auditing framework, ICO
• European Parliament resolution on artificial intelligence in a digital age, EUR-Lex
• Regulation (EU) 2024/1689, EUR-Lex