GDPR for AI Chatbots — Compliance Guide for Non-EU Companies

AI chatbots — whether powered by ChatGPT, Claude, Gemini, open-source LLMs, or custom models — process extensive user data. If your chatbot serves EU users, GDPR applies fully, and Article 27’s EU Representative requirement is mandatory for non-EU companies.

Chatbot Data Under GDPR

Every chatbot interaction generates personal data: user questions (may contain personal information), IP addresses, session metadata, conversation history, and optionally account/profile data. If the chatbot stores conversations for training or quality improvement, this is ongoing personal data processing.

LLM Providers as Data Processors

OpenAI API, Anthropic API, Google Gemini API — these are data processors under Article 4(8). You need a DPA with each provider. Critically, many LLM providers train on API data by default unless you opt out. If your chatbot processes EU user data, ensure training data opt-out is enabled.

Chat Data Retention

How long do you store chat conversations? After the support interaction ends, retention should be minimized. Common approach: 30 days for quality review, then anonymise or delete. Document retention criteria in your ROPA.

Transparency Requirements

Users must be informed that they are interacting with an AI, what data is collected, how it’s processed, and who their EU Representative is. Article 13 requires this information to be provided at the time of data collection — i.e., when the chatbot starts the conversation. Include EU Rep contact in your chatbot Privacy Notice.

Compliance Checklist

1. Appoint EU Shield as EU Representative
2. Sign DPAs with all LLM providers
3. Disable training data usage for EU user chats
4. Update Privacy Policy with chatbot data processing
5. Implement chat retention schedule (30 days then delete)
6. Add EU Rep contact to chatbot interface

Get started →