Running a GDPR-Compliant Chatbot: Requirements, Risks and Solutions

Why GDPR Matters for Chatbots

Chatbots on B2B websites almost always collect personal data — even if you don’t intend them to. The IP address alone is enough to trigger the GDPR. On top of that come conversation content, email addresses and company data that users enter in the chat.

GDPR Requirements at a Glance

1. Legal basis (Art. 6 GDPR)

To operate a chatbot you need a legal basis:

• Consent (Art. 6(1)(a)): the user actively agrees to the data processing — the safest route
• Legitimate interest (Art. 6(1)(f)): can be argued, but is contestable
• Contract performance (Art. 6(1)(b)): only if the chatbot is part of a contract

Recommendation: consent via a cookie banner before the first chatbot interaction.

2. Information obligations (Art. 13/14 GDPR)

Your privacy policy must state:

• That a chatbot is being used
• What data is collected
• For what purpose
• Who the data is shared with (e.g., an AI provider)
• How long the data is stored
• The user’s rights (access, deletion, objection)

3. Data processing (Art. 28 GDPR)

If an external provider operates the chatbot or processes the data, you need a data processing agreement (DPA) with:

• The chatbot software provider
• The AI API provider (OpenAI, Anthropic, etc.)
• The hosting provider

4. Third-country transfers (Art. 44-49 GDPR)

If data flows to the US or other third countries:

• EU-US Data Privacy Framework: possible for certified US companies
• Standard Contractual Clauses (SCCs): contractual safeguard
• EU hosting: the safest route — data never leaves the EU

5. Data minimization and deletion

• Only collect data that is really needed
• Delete conversation data after a defined period (e.g., 30-90 days)
• Anonymize where possible
• No unnecessary sharing with third parties

Chatbot Solutions and Their GDPR Suitability

Solution	Hosting	GDPR status	DPA available
Own chatbot (self-hosted)	EU (own server)	Very good	Not needed
Intercom	US/EU selectable	Good (with EU hosting)	Yes
Drift	US	Critical	Yes, but US processing
HubSpot Chatbot	EU selectable	Good	Yes
Custom (Claude API, EU region)	EU (AWS Frankfurt)	Good	Yes (Anthropic DPA)
ChatGPT Widget	US	Critical	Limited

Best Practices for GDPR-Compliant Chatbots

1. Consent before the chat

The chatbot should not automatically collect data. Either:

• A cookie banner with a chatbot category
• Or: a consent notice within the chat itself (“By using this chat, you agree…“)

2. Prefer EU hosting

Where possible: use the AI API via EU regions (AWS Frankfurt, Azure West Europe). This eliminates the third-country transfer problem entirely.

3. Don’t ask for unnecessary data

Only ask for what you really need in the chat:

• Needed: name, email (if follow-up is desired)
• Not needed: phone, address, date of birth

4. Limit conversation data

• Define a retention period (30-90 days)
• Automatic deletion once the period expires
• Anonymization for analytics

5. Transparency

Make it clear that this is an AI chatbot — not a human. The EU AI Act’s transparency obligation requires this in addition to the GDPR.

Checklist: GDPR-Compliant Chatbot

• Legal basis defined (consent recommended)
• Privacy policy includes a chatbot section
• Cookie banner covers the chatbot
• DPA signed with the chatbot provider
• DPA signed with the AI API provider
• EU hosting or SCCs for third-country transfer
• Deletion concept defined and implemented
• Users are informed they’re chatting with AI
• Opt-out option available
• Data minimization implemented

Conclusion

Running a chatbot in a GDPR-compliant way is achievable — but requires careful planning. The safest solution: an EU-hosted chatbot with consent, a DPA, and a transparent privacy policy. For B2B companies in the DACH region, an own or EU-hosted chatbot is the best choice — US-based solutions without EU hosting are an avoidable risk.