The GDPR-Compliant Chatbot Checklist for Small Businesses

An AI chatbot on your website processes personal data the moment a visitor types a message — a name, an email address, sometimes far more. GDPR applies to that processing exactly as it applies to any other customer data you handle. The good news is that GDPR compliance for a chatbot isn't mysterious: it comes down to a handful of concrete, checkable requirements. This checklist walks through them so you can evaluate a chatbot vendor, or your own set-up, with confidence.

Why chatbots need special attention

A chat widget can quietly become one of the richest sources of personal data on your site: names, contact details, appointment preferences, sometimes health- or finance-adjacent questions typed in good faith by a visitor who assumes they're talking to a person. Because the data arrives as free text rather than a structured form, it's easy to under-estimate how much personal information actually flows through it — which is exactly why it deserves its own checklist rather than being waved through as 'just another form'.

The checklist

• EU data residency: the chatbot vendor stores and processes conversation data within the EU, not routed through infrastructure outside it without an appropriate transfer safeguard.
• A Data Processing Agreement (Article 28 GDPR) is in place between you and the vendor, naming the vendor as processor and you as controller.
• A clear legal basis for processing chat data — typically consent for marketing-adjacent uses, or legitimate interest for handling a genuine enquiry.
• Data minimisation: the chatbot only asks for what it actually needs to answer a question, book an appointment, or capture a lead — not a full profile 'just in case'.
• A defined retention period for conversation transcripts, with automatic or documented deletion once that period ends.
• Sub-processor transparency: you can find out which other vendors (hosting, the underlying AI model provider) touch the data, and on what legal basis.
• No unnecessary collection of special category data (health, religion, biometric data, and similar) unless there's a specific, justified reason and legal basis for it.
• A working process for data subject rights requests — access, correction, and erasure — that actually reaches chat transcripts, not just your CRM.
• Encryption of data in transit and at rest.
• A privacy notice that mentions the chatbot specifically, not just a generic 'we use cookies' banner.

What counts as 'EU hosting' — and why it matters

EU hosting means the servers that store and process your chatbot's data sit within the EU, which keeps the data inside the framework GDPR was built around and avoids the extra safeguards (standard contractual clauses, adequacy decisions) that international transfers otherwise require. It's worth checking two things separately: where the platform itself is hosted, and where the underlying AI model actually processes the conversation, since these are sometimes different vendors with different locations.

Consent, or legitimate interest?

Not every chat interaction needs an explicit consent tick-box. If a visitor opens your chatbot to ask about opening hours or to request a callback, that's ordinarily covered by legitimate interest — you're responding to a request they initiated. Consent becomes the relevant basis once you move beyond answering the immediate question: adding someone to a marketing list from a chat conversation, for instance, needs its own, separately obtained consent, not an assumption that 'they chatted with us, so they're fine with emails'.

What the fines actually look like

GDPR fines can reach up to 4% of a company's total worldwide annual turnover, or €20 million, whichever is higher. In practice, the highest fines have gone to large organisations with systemic failures rather than small businesses with a minor documentation gap — but the ceiling exists, and regulators have shown they're willing to act on chatbot-specific complaints, particularly around consent and data minimisation. Treat the checklist above as risk reduction, not box-ticking.