By Martin Scott

. 6 min read

If your team pastes customer emails, support tickets or call notes into an AI chatbot, the rules that apply are those already in the GDPR, adopted in 2016. The EU’s proposed GDPR changes are still a negotiating text, so nothing in them lowers what a small team owes today.

That leaves five checks, each tied to an article. Here is what the legal text says, what regulators have said about chatbots, and where vendor marketing blurs the two.

First, work out who is responsible

The General Data Protection Regulation splits the roles. A controller “determines the purposes and means of the processing of personal data” (Article 4(7)). A processor “processes personal data on behalf of the controller” (Article 4(8)).

When your agency decides to run client data through a chatbot, you are normally the controller. The AI vendor is, at best, your processor.

Ireland’s Data Protection Commission sets out the homework in its guidance on AI and large language models. It says a business using such a product could be a controller, and should first understand “what personal data it uses, how it uses it, where the personal data goes.” It should also know whether the data “is retained by the provider of the AI product or re-used in any way.”

Check 1: a lawful basis for each use

Article 6(1) says processing “shall be lawful only if and to the extent that at least one of the following applies.” It then lists six grounds. For most business chatbot use, two matter: contract, under point (b), and legitimate interests, under point (f).

Point (f) is narrower than it sounds. It applies “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.”

The European Data Protection Board, the group of EU privacy regulators, applied that test to AI in its December 2024 opinion on AI models. It used a conversational agent as an example. Such services, it said, “can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected.” Write the balancing down.

Health data is a separate problem. Article 9(1) says processing “data concerning health,” among other special categories, “shall be prohibited” unless an exception in Article 9(2) applies. Clinics should treat this as a stop sign.

Article 5(1)(c) adds data minimization: personal data must be “adequate, relevant and limited to what is necessary.” Stripping names and account numbers from a ticket before prompting is the cheapest compliance step there is.

Check 2: a real processor contract

“GDPR compliant” on a pricing page is a claim, not a legal category. What the regulation asks for is a contract. Under Article 28(3), processing by a processor “shall be governed by a contract or other legal act.”

That contract must say the processor “processes the personal data only on documented instructions from the controller” (Article 28(3)(a)). It must cover deleting or returning the data when the service ends (Article 28(3)(g)). The processor also needs your written authorization before it brings in another processor (Article 28(2)).

So read the terms of the plan you pay for. If they let the vendor reuse your inputs for its own purposes, such as training, that goes beyond your documented instructions and needs its own look. If an account comes with no data processing agreement at all, client data should stay out of it.

Check 3: where the data travels

Article 44 says a transfer of personal data outside the EU “shall take place only if” the conditions in Chapter V are met. That binds the controller and the processor alike.

The first route is an adequacy decision under Article 45. The European Commission’s list of adequacy decisions covers the United States only for companies taking part in the EU-US Data Privacy Framework. The Commission also has to review those decisions periodically. Check that your vendor is on the framework list, not just that it is American.

The second route is Article 46, “appropriate safeguards.” Most often that means the Commission’s standard data protection clauses (Article 46(2)(c)), which usually sit inside the vendor’s data processing agreement.

Check 4: no decisions by the machine alone

Article 22(1) gives people “the right not to be subject to a decision based solely on automated processing, including profiling,” where it has legal or similarly significant effects. Screening job applicants or approving refunds with a chatbot can fall into this.

The bar for “solely” may be lower than teams assume. In a case study dated 5 November 2026, Hamburg’s data protection commissioner points to the Schufa ruling of the EU Court of Justice. Its reading is that “AI-generated suggestions may be classified as automated decisions even if they play a decisive role in the subsequent human assessment of the facts.”

That is the regulator’s interpretation of the 2023 judgment in case C-634/21, not a new ruling. It is still a useful signal of how at least one German authority may look at “a human signed off on it.”

The same document shows what the regulator did in its own office. It now uses LLMoin, a chatbot built for the city’s administration, to help draft letters on complaints, after receiving 4,220 complaints in 2025, up 62% on the year before. Its rules prohibit automated decisions, and staff must read the full case file rather than be guided by an AI summary. It does not let the tool draft notices of appeal rights, because that wording must be exact.

Check 5: an impact assessment when the risk is high

Article 35(1) requires a data protection impact assessment, or DPIA, which is a written analysis of risks and safeguards. It must happen “prior to the processing” where processing is “likely to result in a high risk to the rights and freedoms of natural persons.”

Article 35(7) lists the minimum contents: a description of the processing, a necessity check, a risk assessment and the safeguards. Hamburg says it began with a phase where personal data was not allowed at all, and fed its test results into the DPIA.

Small firms often count on Article 30(5), which exempts organizations “employing fewer than 250 persons” from keeping records of processing. Our reading is that it helps less than it seems. The exemption falls away if the processing “is not occasional,” and a chatbot the whole team uses daily is hard to call occasional.

What getting it wrong can cost

Article 83 sets two fine ceilings. Breaches of the processor, records and DPIA rules (Articles 25 to 39) carry up to €10 million or 2% of worldwide annual turnover, whichever is higher.

Breaches of the basic principles, the lawful bases, people’s rights under Articles 12 to 22, and the transfer rules carry up to €20 million or 4%. Those are ceilings. Article 83(2) tells regulators to weigh factors such as negligence and what a company did to limit the damage.

What the Digital Omnibus would change, and when

On 21 October 2026, EU governments agreed the Council’s negotiating position on the Digital Omnibus GDPR amendments. The Council says its mandate “maintains the current definition of personal data.” It also adds “clarifications on the lawful ground for processing personal data” for AI.

None of that is law. Talks with the European Parliament start only once Parliament adopts its own position, and the institutions aim to finish all simplification packages by the end of 2027. The AI Act part is a separate law that already passed; we covered which AI Act deadlines moved and what small teams still owe earlier this week.

What to do this week

  • List every AI tool your team uses with customer data, including note takers. Our comparison of AI meeting notes in Meet, Zoom, Teams and Notion covers where transcripts are stored.
  • For each tool, find the data processing agreement. Check for documented instructions only, deletion at the end, and a transfer route.
  • Write one paragraph per use on the lawful basis. If you rely on legitimate interests, record the balancing.
  • Give any decision about a person, such as hiring or refunds, to a named human who reads the source material.
  • Review settings that link chatbots to company systems, such as Claude’s automatic connections to company apps. Each new connection widens the personal data the tool can reach.

This guide explains the legal text and published regulator guidance. It is not legal advice for a specific case.

Sources

Martin Scott

Martin Scott is the editor for business and policy at AI Observer, covering startups and deals, regulation, health and science, and AI agency profiles. He follows the money and the legal text, and separates what a rule says from what people claim it says. His style is analytical and plain-spoken.

Spotted a mistake? Tell us on the corrections page.

Conversation

Every comment is reviewed before it appears, so there can be a short delay.