GDPR-ready AI chatbots: what UK businesses should check

An AI chatbot on your website collects personal data from the first message: names, email addresses, order numbers and sometimes health or financial details. Behind the chat window, those messages usually go to an AI provider, are stored in a database and may be passed to your CRM or help desk. This guide walks through the UK GDPR points to check, based on guidance from the Information Commissioner's Office (ICO). It is general information, not legal advice; for advice about your organisation, use the ICO's resources or speak to a data protection professional.

Which lawful basis covers chatbot conversations?

Article 6 of the UK GDPR says you must apply at least one lawful basis whenever you handle personal information. For a business chatbot, the usual candidates are:

• Contract: answering questions about an order or booking, or taking steps a person has asked for before a contract, such as preparing a quote.
• Legitimate interests: answering general enquiries, where your interests are not overridden by a good reason to protect the person's information.
• Consent: for example, if the chatbot offers to add someone to a marketing list. Consent must be clear and given for a specific purpose.

Decide the basis for each purpose before launch and record it. The ICO notes that you cannot usually swap from consent to a different basis later, so choose carefully.

What should you tell people before they chat?

The ICO's guidance on AI and transparency says your privacy information should cover, at a high level, your purposes for processing, your retention periods and who you share the data with. If you collect data directly from people, you must give them that information at the time you collect it.

For a chatbot, that means:

• a short line in the chat window saying people are talking to an AI assistant, with a link to your privacy notice;
• a section in the privacy notice describing the chatbot, the AI provider you use, what happens to conversations and how long you keep them;
• a clear way to ask for a person instead.

Saying plainly that the assistant is an AI system is the simplest way to be transparent.

How much data should the chatbot collect and keep?

The data minimisation principle says personal data must be adequate, relevant and limited to what is necessary for your purpose. The storage limitation principle says it must not be kept for longer than you need it, and the ICO says you should periodically review what you hold and erase or anonymise data you no longer need.

Practical steps:

• ask only for the details the chatbot needs to help, such as an email address for a follow-up;
• tell the chatbot not to ask for payment card details, passwords or health information, and to steer people to a secure channel instead;
• set a retention period for transcripts and delete or anonymise them on a schedule;
• make sure you can find and delete a person's conversations if they ask.

What must your contract with the AI provider say?

When an AI provider or chatbot platform processes conversations on your behalf, it is normally your processor, and Article 28 of the UK GDPR requires a written contract. The ICO lists the minimum terms, which include:

• processing only on your documented instructions;
• a duty of confidence for anyone handling the data;
• appropriate security measures;
• rules on using sub-processors, with notice of changes and a chance to object;
• help with people's rights requests;
• deletion or return of the data at the end of the contract;
• audits and inspections.

Large AI providers usually publish a standard data processing addendum: read it, and check which company you contract with.

Will the AI provider train its models on your customers' messages?

This depends on the provider and the plan, so check the current terms rather than assuming. Two examples from the providers' own documentation:

• OpenAI's platform documentation says that, since 1 March 2023, data sent to the OpenAI API is not used to train or improve its models unless you explicitly opt in. It also explains that abuse monitoring logs, which may contain prompts and responses, are kept for up to 30 days by default, with stricter retention controls available to approved customers.
• Google's Gemini API terms say that content submitted to unpaid services may be used to improve Google's products and read by human reviewers, and tell users not to submit personal information to them. For paid services, Google says it does not use prompts or responses to improve its products. The same terms say that only paid services may be used when offering apps to users in the United Kingdom.

Use business or API plans for customer-facing chatbots, switch off optional data-sharing settings and record what you chose.

What if the AI provider is outside the UK?

Most AI providers process data outside the UK. The ICO explains that the transfer rules apply when the UK GDPR applies to your processing, you initiate the transfer, and the receiving organisation is a separate legal entity. That is a restricted transfer, and every restricted transfer must be covered by UK adequacy regulations, appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum, usually with a transfer risk assessment), or an exception. Ask your provider which mechanism it relies on and keep a copy.

Do you need a DPIA for an AI chatbot?

Article 35 of the UK GDPR requires a data protection impact assessment (DPIA) where processing is likely to result in a high risk to people's rights and freedoms. The ICO's list of processing likely to be high risk includes innovative technology, including AI, where it is combined with any of the criteria in the European guidelines, such as large-scale processing or vulnerable people. The ICO adds that if you are in any doubt, it recommends doing a DPIA. A chatbot that handles health questions, financial details or conversations with children is a strong candidate. Note that the ICO says this guidance is under review following the Data (Use and Access) Act 2025.

When do the rules on automated decisions apply?

Most website chatbots answer questions and do not make decisions about people. The rules change if a chatbot decides something with a legal or similarly significant effect without meaningful human involvement, such as a decision on a loan application. The ICO calls these significant decisions.

Following the Data (Use and Access) Act 2025, which amended the UK GDPR, the rules on these decisions are set out in Articles 22A to 22D. The ICO says the Act opens up the full range of lawful bases, potentially including legitimate interests, for significant automated decisions, provided appropriate safeguards are in place, but not for special category data. The ICO's updated draft guidance, published for consultation in March 2026, explains that the safeguards must let people get information about the decision, make representations, obtain human intervention and contest the decision.

If your chatbot does anything close to this, design human review in from the start.

How should you secure the chatbot and hand over to people?

The UK GDPR requires appropriate technical and organisational security. For a chatbot, that usually means:

• encrypted connections and restricted, logged access to transcripts;
• individual staff logins with multi-factor authentication for the chatbot dashboard;
• testing that users cannot make the chatbot reveal its instructions, other people's data or internal systems;
• reviewing which systems the chatbot can read from or write to, and limiting it to what it needs.

Let people ask for a person at any point, pass the conversation over with its history so they do not have to repeat themselves, and make sure someone checks the queue.

If you are planning a chatbot, our AI chatbot development page explains how we build them, and our UK AI chatbot development page covers our work for UK businesses. For the rest of your website, see our guide to UK GDPR and cookie consent.

Sources

• ICO: A guide to lawful basis
• ICO: How do we ensure transparency in AI?
• ICO: Principle (c): Data minimisation
• ICO: Principle (e): Storage limitation
• ICO: What needs to be included in the contract?
• ICO: A brief guide to international transfers
• ICO: International transfers
• ICO: When do we need to do a DPIA?
• ICO: Automated decision-making, including profiling
• ICO: What are the ADM safeguards?
• ICO: The Data (Use and Access) Act 2025: what does it mean for organisations?
• OpenAI: Data controls in the OpenAI platform
• Google AI for Developers: Gemini API Additional Terms of Service