A GDPR-compliant chatbot in your language: what an SMB can’t forget

Since GDPR came into force, European regulators have issued more than 2,800 fines totalling over €6.2 billion — more than 60% of that since January 2023. A misconfigured chatbot isn’t a theoretical risk; it’s one of the most common triggers.

The good news is compliance fits into five practical steps.

1. Tell the user they’re talking to AI

Mandatory under the EU AI Act and reinforced by several national authorities. A single opening sentence solves it: "I’m an automated assistant from [company]. If you’d rather talk to a person, just say 'person' at any time."

2. Collect only what’s strictly necessary

If you’re booking an appointment, you don’t need the address. If you’re answering a question, you probably don’t need the email. Every field asked has to have a justification tied to the purpose — that’s the minimisation principle.

GDPR (and recent guidance from national data protection authorities) doesn’t accept blanket consents. If the chatbot does three things — handle requests, send promotions, feed the CRM — it needs three separate consents, not one generic checkbox.

4. Sign a DPA with the vendor

Before going live, demand a signed Data Processing Agreement (DPA) from the vendor. Without it, you’re the sole controller for the data the vendor processes. Full stop.

5. Choose EU data residency

Every major vendor now offers an EU hosting option. Always request written confirmation that your users’ data stays in European datacentres — including prompts and responses used for logging or tuning.

What stays your responsibility

Two things no vendor can do for you:

DPIA (impact assessment) for chatbots handling sensitive data or operating at scale. Not a long document — but it has to exist.
Privacy policy updated with a specific section on AI use, data processing, and user rights (access, portability, deletion).

An organised SMB has all of this in two mornings of work. A small investment today is worth much more than a fine tomorrow.