Start with the lawful basis, not the architecture

Before choosing where a chatbot's data is processed, GDPR requires a clear lawful basis for collecting and processing it in the first place - consent, legitimate interest, or contractual necessity, depending on the use case. A support chatbot answering a logged-in customer's account question sits on different lawful-basis footing than an anonymous marketing chatbot collecting visitor data.

Getting this wrong upstream makes every downstream architecture decision moot - a beautifully residency-compliant system built on the wrong lawful basis is still non-compliant.

Data residency: know where the model actually processes the conversation

EU businesses increasingly ask, and are increasingly asked by their own customers, exactly where an AI chatbot's underlying processing happens. This is a real architectural decision - not every AI provider offers the same regional processing options, and the answer needs to be documented clearly enough to satisfy a data protection impact assessment.

Retention terms follow the same logic: how long is a conversation kept, is it used for any purpose beyond answering the immediate query, and can a customer's data actually be deleted end to end on request - including anything a third-party model provider retained.

Know your processing location

Document exactly where chatbot conversation data is processed - this is a standard question in EU vendor and DPIA reviews now.

Make deletion actually work

A GDPR erasure request needs to reach every system holding the data, including any third-party model provider's retained logs.

This is a build decision, not a policy afterthought

The cleanest way to satisfy all of this is architecting the chatbot with data residency and retention controls built in from day one - rather than launching first and trying to retrofit a data protection impact assessment onto an architecture that wasn't designed with it in mind.

Need a GDPR-compliant chatbot architecture scoped from the start? Talk to us about the right approach.

Key takeaways

  • Establish the lawful basis for collecting and processing chatbot conversation data before any architecture decision - the wrong lawful basis makes the rest of the compliance work moot.
  • Data residency - where the chatbot's underlying model actually processes conversations - is now a standard question in EU vendor reviews and data protection impact assessments.
  • Retention and deletion need to work end to end, including any data a third-party model provider retains, not just your own primary database.
  • Build data residency and retention controls into the chatbot architecture from day one rather than retrofitting them after launch.
This is general information, not legal advice. Your specific GDPR obligations depend on your data flows and processing purposes - consult qualified EU data protection counsel.