GDPR and AI chatbots for customer service

GDPR applies to AI chatbots in customer service whenever the conversation involves personal data, such as names, phone numbers or delivery addresses, and it can reach businesses outside the EU that serve people in the EU. The rules are manageable: collect only what you need, be transparent, keep access secure and choose a chatbot vendor who can explain clearly where and how data is kept. This article explains the basics in general terms and how they relate to the rules in Albania and Kosovo. It is not legal advice: for your specific case, consult a lawyer.

What GDPR is and why it can apply outside the EU

The GDPR, the General Data Protection Regulation, is the European Union's law on personal data and has applied since May 2018. It doesn't cover only businesses inside the EU: in general, it also applies to businesses outside the EU that offer goods or services to people who are in the EU. An online store in Tirana that ships to Italy or regularly serves diaspora customers in Germany should take that seriously.

Even without EU customers, the principles are almost the same. Albania, an EU candidate country, has aligned its personal data protection legislation with the GDPR, and its supervisory authority is the Information and Data Protection Commissioner (IDP). In Kosovo, the role belongs to the Information and Privacy Agency. In practice, if you follow GDPR principles, you are on the right track in both countries.

GDPR principles applied to an AI chatbot

Here is what the core GDPR principles look like in a customer chat:

• Transparency. Customers should know who processes their data and why. Publish an easy-to-read privacy policy and place a link to it near the chat or on your business profile.
• Purpose limitation. A phone number collected for delivery isn't automatically available for promotional messages. Marketing needs its own legal basis, often the customer's consent.
• Data minimisation. Ask only for what you need. A question about price doesn't need an address; an order doesn't need a date of birth.
• Accuracy. Keep data up to date, for example when a customer changes their address.
• Storage limitation. Don't keep conversations and contacts forever without a reason. Set clear retention periods.
• Security. Only the people who need access to conversations should have it, with strong passwords and two-step verification wherever possible.
• Accountability. You should be able to show what you do with the data and why.

Sensitive data needs extra care

Some kinds of data, such as health data, are special categories with stronger protection. That directly affects clinics. Take a dental clinic in Prishtina where a patient writes in the chat: "My tooth has been hurting for three days, can I come in tomorrow?" To book an appointment, the clinic needs only the name, contact details and a short reason for the visit. The assistant shouldn't ask for a medical history or give diagnoses.

A few simple rules for every business:

• never ask for card numbers, passwords or photos of ID documents in a chat;
• for clinics and salons, collect only the appointment request and leave the medical part for the visit;
• tell your team not to copy customer data into private messaging groups or unprotected files.

If you run a clinic, see our page for clinics.

Who is responsible for what

Controller and processor

In GDPR terms, your business is usually the controller: you decide why and how customer data is processed. The AI platform you use is usually the processor: it processes the data on your behalf and according to your instructions. The GDPR requires that this relationship be governed by a written data processing agreement.

Questions to ask your AI chatbot vendor

Before you choose a platform, ask:

1. Where is conversation data stored, and who has access to it?
2. Are your customers' conversations used for any purpose other than serving you?
3. How long are conversations kept, and can you delete them whenever you want?
4. Does the vendor offer a data processing agreement?
5. What happens to the data if you stop using the service?
6. When the AI doesn't know the answer, does it hand the conversation to a person, or does it keep guessing?

More questions like these are in how to choose an AI chatbot platform. The last one is also about quality: a system that makes things up gives customers inaccurate information, as we explain in why AI makes up answers.

Customer rights and transparency about AI

Your customers have the right to ask to see the data you hold about them, to have it corrected and, in many cases, deleted. The GDPR usually requires you to respond to these requests within one month. Set up a simple process: who on the team receives these requests, where they find the data and how they confirm deletion.

Customers should also know they are talking to an AI assistant: it is good practice, and the EU AI Act turns it into an obligation in many cases, as we explain in the EU AI Act for small businesses.

How AsistentiAI handles customer data

At AsistentiAI, data is handled carefully and your business's data stays your business's. Each business has its own isolated space, the database is in the EU (Frankfurt), and data is never sold or used for advertising or to train general models. Our privacy policy is published so you can read it before you decide.

The way the agent works helps too. It never makes up prices, stock or policies; when it isn't sure, it tells the customer honestly and hands the conversation to your team, marked "Needs you" in the dashboard. All conversations from Instagram, Messenger, WhatsApp and your website chat are in one place, so you always know what customers were told, and the team can take over at any time. Every colleague has their own role and permissions, and sign-in is protected with two-step verification or passkeys.

You can request a free trial with 50 agent replies and no credit card; our team opens your account within the day.

Frequently asked questions

Does GDPR apply to AI chatbots?

Yes, whenever the chatbot processes personal data of people in the EU, such as names, phone numbers or addresses. The business using the chatbot is usually the controller and the chatbot provider the processor.

Does GDPR apply to businesses in Albania or Kosovo?

It can, if you offer goods or services to people in the EU, for example by shipping to Italy or Germany. Albania's data protection law is aligned with the GDPR, so its principles are a good guide anyway. Ask a lawyer about your case.

Can an AI chatbot collect health information from patients?

Health data is a special category with stronger protection. To book an appointment, a chatbot should collect only the name, contact details and a short reason for the visit.

Do I need a data processing agreement with my chatbot provider?

Under the GDPR, the relationship between a controller and a processor must be governed by a written agreement. Ask your provider for one before you go live.

Privacy is not an obstacle to using AI; it is a condition for using it well. Customers trust businesses that treat their data with respect: ask only for what you need, choose transparent vendors and keep people in control. For questions specific to your business, a specialised lawyer is always worth consulting.