GDPR and AI Chatbots: Staying Compliant in Sales Automation

The GDPR and AI chatbots get along well if you follow a few basic rules. Problems rarely come from the AI itself. They come from missing contracts, unclear retention periods or automated marketing messages sent without consent. This article goes through the points you should settle before using a chatbot in sales, and ends with a checklist.

GDPR and AI chatbots: what data sales generates

A chatbot that qualifies enquiries collects more than you might think: names, phone numbers and email addresses, details of the project, sometimes addresses or budgets, plus technical data such as IP address and time. On the phone, voice recordings or transcripts are added. All of this is personal data within the meaning of the GDPR.

Things get particularly sensitive when customers volunteer more than they're asked. A patient writes to the practice in the chat explaining why she needs an appointment. A client describes his case to the law firm. Health data is one of the special categories under Art. 9 GDPR and enjoys extra protection, and doctors, lawyers and tax advisers are also bound by professional confidentiality. Plan for these situations from the outset.

Legal basis: when you may process data

For most chat situations in sales, three legal bases come into question:

• Steps prior to a contract: if someone asks for a quote or an appointment, you may process their data for that purpose.
• Legitimate interest: answering general questions and sorting enquiries can usually rest on this. The users' interests have to be weighed against yours.
• Consent: you will almost always need it for advertising, newsletters and later follow-ups by email or WhatsApp. It must be freely given, informed and verifiable.

There is one more point about the website itself. If the chat window stores or reads information on the visitor's device when it loads, such as cookies that aren't strictly necessary, the TDDDG (German Telecommunications Digital Services Data Protection Act) requires consent. Clarify with the provider what happens technically before anyone has even typed a word.

Here is an example of how a transparent opening could look for a plumbing and heating business:

Hello, I'm the digital assistant of [name of your business]. I'm an AI and I can help you with appointments and questions about our services. We only use your details to handle your enquiry; you'll find more in our privacy policy. If you'd rather speak to a person, just say so.

A text like this does several jobs at once. It makes clear that an AI is replying, points to the privacy information and offers a way out. It shouldn't be any longer, or nobody will read it.

Following up without a cease-and-desist letter: marketing rules

Sales automation often means that further messages follow the chat. Here competition law applies alongside the GDPR. Under § 7 UWG (German Act against Unfair Competition), promotional emails, text messages and messenger messages generally require prior express consent. There is a narrow exception for emails to existing customers about similar products. Marketing calls to consumers are not allowed without prior express consent; in B2B the rules are somewhat looser, but by no means a free-for-all.

In practice, replying to a specific enquiry is fine. An automatic reminder three weeks later with new offers is not, unless you have consent. So have the chatbot ask for consent explicitly, and store when and how it was given.

Provider, contract and server location

The chatbot provider processes data on your behalf. You therefore need a data processing agreement under Art. 28 GDPR. Reputable providers offer one without being asked. Also ask about:

• where the data is processed, including all sub-processors such as language model or hosting providers,
• whether your conversation data is used to train third-party models, which should be excluded by contract,
• the technical and organisational measures, such as encryption and access rights,
• whether conversation logs can be found, handed over and deleted on request.

If data is processed in the USA, there are transfer mechanisms such as the EU-US Data Privacy Framework or standard contractual clauses, but checking compliance takes more work. There is more on this in the article EU or US hosting for AI tools. Neurobots processes data on servers in Frankfurt; ISO 27001 certification is in preparation. The article Why ISO 27001 matters for AI providers explains what role such a standard plays when choosing a provider.

Checklist: a GDPR-compliant AI chatbot in sales

Item	What to do
Privacy policy	Add a section on the chatbot covering purpose, legal basis, recipients and retention period
Notice in the chat	Briefly mention the AI and the privacy policy at the start
Data processing	Sign a data processing agreement with the provider, check sub-processors
Data minimisation	Only ask for the details needed for the next step
Retention periods	Decide how long conversation logs are kept, and delete them automatically
Consent	Ask for it for marketing and follow-ups, and record when it was given
Sensitive data	Set up the chatbot so it doesn't ask for health details or case details
Records	Add the processing to your record of processing activities
Impact assessment	Check whether a data protection impact assessment is needed, especially with sensitive data

For how this fits with the AI Regulation, in particular the duty to make the AI recognisable, read our article on the EU AI Act for SMEs.

When you should do without the chatbot

Some use cases can hardly be solved cleanly under data protection law. A chatbot that asks about symptoms in a medical practice and assesses urgency is one of them. So is one that takes down the facts of a new case in detail at a law firm. Here it's better to limit the bot to appointments and organisational questions and move everything substantive to a personal conversation. Professionals bound by confidentiality must also oblige any service providers they use to keep secrets. In these cases, get advice from your data protection officer or your professional chamber. This article is not legal advice.

Frequently asked questions

Do I need a data protection officer for the chatbot?

Whether you have to appoint one depends, among other things, on how many employees regularly process data and on the type of data. Either way, it's worth having a qualified person review the chatbot before launch.

How long may I keep chat logs?

For as long as you need them for the purpose, for example until the enquiry is dealt with or a contract is signed. After that, the usual retention rules apply. Set a fixed period and have the logs deleted automatically.

Do I have to hand over every conversation on request?

Yes, data subjects have a right of access. Your system should therefore be able to find and export a person's conversations quickly. Ask the provider in advance how this works.

How do I recognise a trustworthy provider?

By a ready-made data processing agreement, clear information on server location and sub-processors, and understandable answers to security questions. Our checklist for evaluating AI providers and the article on AI data security will help you check.

Conclusion

You can run an AI chatbot in sales in line with data protection law if the contract, server location, retention periods and consents are sorted and the bot only asks for what it really needs. The biggest risks are automated marketing messages without consent and sensitive details that end up in the chat unprompted.

The page Digital receptionist for law firms shows how to set up a digital reception that respects a law firm's duty of confidentiality.