The short answer
Before a chatbot goes live you need a lawful basis for the data it handles, a privacy notice visible at the start of the chat, a data processing agreement with each provider involved, a known location for the data, limits on what it collects, a retention rule and an easy route to a human. Write each decision down.
This guide explains each point in plain terms, where the awkward parts usually are and how to test the chatbot before it faces the public. It is general information and not legal advice, and the law has been updated recently, so your data protection adviser should sign off the final setup against current ICO guidance.
What personal data a chatbot actually touches
A chatbot does not need a sign-up form to handle personal data. People type their names, email addresses, order details and sometimes health or financial information into a chat box without being asked. Under UK GDPR that is personal data as soon as it can be linked to a person, and the chat log itself counts too.
List what the chatbot will see. That usually includes the messages, any form fields it fills in, technical data such as an IP address, and whatever it looks up from your systems to answer a question. Each item on that list needs a reason for being there, and anything without a reason should be removed or blocked.
The checklist
Work through these points before launch and keep the answers in one document. A short written record is far more useful than a long policy nobody reads.
- Lawful basis. Decide whether you rely on legitimate interests, contract or consent for the chat, and write down why. Many business chatbots use legitimate interests or contract, but the choice depends on what the bot does.
- Privacy notice. Tell people at the start of the chat that they are talking to an AI, which is good practice, and explain what is collected, why, who receives it and how long it is kept, with a link to your full notice.
- Processor terms. Every provider that handles conversations, such as the chatbot platform, the hosting company and the AI model provider, should give you a data processing agreement.
- Data location. Know where the conversations are stored and processed. If any of it leaves the UK, ask which transfer safeguard the provider relies on.
- Data minimisation. Collect only what the chatbot needs. Do not ask for dates of birth, account numbers or health details unless there is a clear purpose.
- Retention. Set a deletion period for chat logs and apply it. Keeping everything forever is one of the most common gaps.
- Human handover. Offer a clear way to reach a person, and make sure the handover includes the conversation so customers do not repeat themselves.
- Rights requests. Be able to find, export and delete a person's chat history if they ask.
- Model training. Confirm in writing whether conversations are used to train the provider's models.
- Testing and records. Test the bot with awkward questions, and keep a record of the assessment you made before launch.
Where the data goes
Most AI chatbots send each message to a language model run by another company. That makes the model provider a processor, and it makes the location of its servers a real question. The UK currently recognises the EEA as adequate for transfers, but a provider that processes data in other countries needs a recognised safeguard, and you should ask which one it uses rather than assume.
Ask the provider three plain questions. Where is the data processed, how long is it kept, and is it used to train models. Business and API terms often differ from the consumer version of the same product, so read the terms that apply to you. If the answers are vague, treat that as a finding and choose a different provider.
Human handover and automated decisions
UK data protection law sets safeguards for decisions made solely by automated means when they have a legal or similarly significant effect on someone. A chatbot that answers opening hours questions is nowhere near that line. A chatbot that approves or refuses refunds, credit or bookings on its own might be, so design it to propose and let a person decide.
Handover is also good service. Set clear triggers, such as a request for a person, a complaint, a repeated failure to answer or a sensitive topic. When a handover happens the bot should say so, pass over the conversation and tell the customer what to expect next.
Things that catch businesses out
The chat widget itself often sets cookies or loads scripts from another company, so it falls under the cookie rules in PECR as well as UK GDPR. Check what loads on your pages and whether your consent banner covers it.
Staff pasting customer details into public AI tools is another common gap, and an internal rule is needed alongside the website bot. The last one is answers that sound confident but are wrong. Limit the bot to your own approved information, tell it to say when it does not know, and review real conversations in the first weeks. Wrong answers about prices, policies or deadlines are a business risk before they are a data risk.
How we set this up
RAWR Productions builds AI assistants that answer from a business's own information, take enquiries and bookings and hand over to a person when they should. The assistant proposes and a person approves. We set up each one with data processing agreements, data minimisation and a written record of what data goes where, using the model providers' API business terms, under which client data is not used to train public models.
Our automations run on our own server in the EU, in Frankfurt, and we can use the client's own server on request. A website assistant typically takes two to four weeks. Your data protection adviser signs off the documented setup. The first step is a free 20-minute intro call, followed by a fixed quote in writing.
Questions
Do I need a privacy notice for an AI chatbot?
Yes. You must tell people what data you collect, why you use it, who receives it and how long you keep it. For a chatbot, a short message in the chat window that says it is an AI and links to your full privacy notice is the usual approach.
Does a chatbot need user consent under UK GDPR?
Not always. Many business chatbots rely on legitimate interests or contract rather than consent, but you must choose a basis and record why. Cookies or tracking scripts loaded by the widget may still need consent under PECR. This is general information and not legal advice, so confirm with your adviser.
Can I use ChatGPT or another model provider with customer data?
Only on business or API terms that give you a data processing agreement, clear information on where data is processed and a statement on training. The free consumer version of a tool is a different product with different terms. Read the terms that apply to your account, and ask the provider if anything is unclear.
Does the data have to stay in the UK?
No. UK GDPR allows transfers abroad when a lawful transfer route or safeguard is in place, and the UK currently recognises the EEA as adequate. What matters is that you know where the data goes, that the provider can show its safeguard, and that your privacy notice reflects it.
What should I do if the chatbot gives a wrong answer?
Correct the source information first, because the bot answers from what you give it. Then review similar conversations, and if the error caused harm, speak to the affected customer directly. Build in a way for customers to flag errors and reach a person, and review logs regularly in the first weeks after launch.