Do AI Chatbots Need to Follow UK GDPR?
Assess AI chatbot privacy through real data flows, supplier roles, lawful purposes, retention and human oversight before using customer conversations.
Part of our guide: UK Website Compliance and Security: A Practical Guide for Small Businesses
An AI chatbot needs to comply with applicable UK data-protection law when it processes personal information. The fact that the conversation is automated does not remove those responsibilities.
A chatbot answering public questions without retaining identifiable information presents a different risk from one handling bookings, customer records or sensitive disclosures. Assess the actual service, not the word “AI” alone.
Define the chatbot’s permitted job
Write down what the bot may answer, what information it may request and when it must hand over to a person. Avoid giving it access to the whole business database just in case a question needs it.
The decision to add a chatbot should come before choosing a vendor. A maintained FAQ or ordinary form may solve the customer problem with fewer data flows.
Keep the assessment within your website compliance plan.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Test the human fallback alongside the principles in website accessibility.
Map every destination for conversation data
Identify the website operator, chatbot platform, model provider, hosting services and any connected booking or CRM tools. Ask who can inspect transcripts and whether data is used for training or other supplier purposes.
Review the contract and configuration together. A setting that disables one use may not remove other logging or retention.
The ICO’s AI and data-protection guidance discusses responsibilities across AI systems. Determine controller and processor roles from the facts, not only the supplier’s label.
Assess lawful use and transparency
Identify a lawful basis for each personal-data purpose and any additional conditions required for special-category information. Do not assume that a visitor typing a message gives valid consent to every possible use.
Explain that the tool is automated, what information should not be submitted and where to find the privacy notice. Put important warnings before the conversation, not after collection.
Get qualified advice if the service involves health information, children, vulnerable people or consequential decisions.
Keep sensitive material out of ordinary chat
Configure prompts and interface wording to discourage unnecessary disclosure, but recognise that people may still type sensitive information.
Decide how staff will handle that situation and how records can be removed or restricted. Do not rely on a disclaimer as your only safeguard.
The guide to customer information in AI chatbots covers practical boundaries. Apply similar care to contact-form data and uploaded files.
Control access and actions separately
Reading information and changing a booking are different permissions. Give integrations only the access needed for the approved task.
Require suitable verification before revealing account-specific information or changing a customer’s record. A confident conversational answer is not evidence of identity.
If the chatbot becomes an agent that performs actions, revisit the assessment using AI website tasks and controls.
Plan retention and rights handling
Know where transcripts are stored, how long they remain and how you can search, export or delete relevant records when required.
Check backups, analytics and support logs as well as the main dashboard. Avoid promising deletion that the supplier cannot implement.
Assess whether a data-protection impact assessment is required, particularly where the proposed processing is likely to create high risks. Record the reasoning even when the tool seems modest.
Test with fictional scenarios first
Use invented enquiries to test incorrect answers, sensitive disclosures, refusal, human handover and supplier failure. Check that the ordinary contact route remains available.
Monitor the live service only through a proportionate, documented process if you later launch it. Review changes to models, integrations and vendor terms.
For website implementation planning, contact AfterWorks. This guide cannot confirm a particular chatbot’s legal compliance.
