Can you put customer data in an AI chatbot? GDPR check

Yes, you can legally put customer data into an AI chatbot, but only when a short list of GDPR conditions all hold at once. The data must not be special category data like health or religion. The AI task must serve the purpose you collected the data for. Your organisation needs a signed processing agreement with the provider that rules out training on your inputs. And you need to know where the data is processed and how long it is kept. Miss one and the answer is no, whatever tool you use.

That is the whole post in one paragraph. The rest is the order to check those things in, why the order matters, and what to do when the answer is "not yet". This is general information, not legal advice. Your data protection officer and your own contracts have the final word.

Is it personal data at all?

Start here, because a lot of what people paste is not personal data, and the GDPR only applies to what is. Article 4 of the GDPR defines personal data as any information relating to an identified or identifiable natural person. The word doing the work is "identifiable".

A name and an email address are obvious. Less obvious: an order number, a customer ID, an IP address, or a description like "the dentist in Utrecht who complained twice about invoice 4471". If someone could reasonably work out who it is, it is personal data. Company data about a business is not personal data, but the name of the person who signed the contract is.

The useful test is in recital 26 of the GDPR: you take into account all the means "reasonably likely to be used" to identify someone, including cost and time. Text that passes that test is anonymous, and the GDPR does not apply to it at all.

So the first move is practical, not legal. Look at what you are about to paste and ask whether the job needs the identifying parts.

Anonymise or pseudonymise first

Most chatbot tasks do not need the name. Summarising a complaint, finding the pattern in thirty support tickets, rewriting a clumsy reply: all of these work with "Customer A" instead of "Marieke de Vries".

Two terms matter here, and they are not the same thing.

	Pseudonymised	Anonymised
What you do	Replace identifiers with placeholders, keep the key	Remove or generalise until nobody can re-identify
Can you link it back?	Yes, with the key you kept	No, by any reasonably likely means
Still personal data?	Yes	No
GDPR applies?	Yes, but the risk is lower	No
Typical chatbot use	Drafting a reply you will personalise later	Analysing themes across tickets

Pseudonymisation is a safeguard the GDPR explicitly rewards. The EDPB's guidelines 01/2025 on pseudonymisation walk through when it works and when it does not. The short version: it only helps if the key stays with you, and if the remaining text does not identify the person by itself. "A 34-year-old customer in a village of 300 people who uses a wheelchair" has no name in it and is still personal data.

Is it special category data?

If the data reveals health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or someone's sex life or sexual orientation, it is special category data under article 9 of the GDPR. Processing it is prohibited unless one of a short list of exceptions applies. Criminal convictions get similar treatment under article 10.

This catches more everyday material than people expect. A support ticket saying "I couldn't pay because I was in hospital" contains health data. A request for a prayer room at an event reveals religion. An HR note about a sick day is health data too.

For chatbot use the practical answer is simple: keep it out of general tools. Not because it can never be lawful, but because making it lawful needs an exception you can point to, a data protection impact assessment (DPIA) under article 35, and usually a tool set up specifically for it. That is a project, not a prompt.

The Dutch data protection authority, the Autoriteit Persoonsgegevens, made the point with a real case in its August 2024 warning about AI chatbots. An employee of a GP practice had entered patients' medical data into a chatbot, against the practice's own agreements.

Medical data are highly sensitive data and are given extra protection by the law for a reason.

That sentence is from the regulator's notice. The same page describes a telecom employee who entered a file of customer addresses into a chatbot. Both were reported as data breaches.

Do you have a lawful basis, and does the AI use fit the purpose?

Here is the part people overthink. Using an AI tool does not need its own lawful basis if it only helps you do the job you already had a basis for. Under article 6 of the GDPR, you already rely on something for handling that customer's data: usually performance of a contract, a legal obligation, or legitimate interest. Drafting a reply to their ticket with a chatbot is the same processing, done with a different tool.

The trouble starts when the AI use is a new purpose. That is where purpose limitation bites. Article 6(4) lists what you weigh when you reuse data for something else:

1. The link between the original purpose and the new one.
2. The context in which you collected the data, and what the customer would reasonably expect.
3. The nature of the data, especially special categories.
4. The possible consequences for the people involved.
5. Safeguards, such as encryption or pseudonymisation.

Two examples make the line clear. Answering a customer's own question with help from AI: same purpose, fine. Feeding five years of support tickets into a model to score which customers are likely to churn, then targeting them with offers: a new purpose, and one most customers would not expect. That second case needs a written compatibility assessment or a fresh basis, and possibly a DPIA.

If a chatbot output will decide something about a person with legal or similarly significant effects, such as refusing a refund claim or rejecting an application, article 22 on automated decision-making comes in as well. Keep a human in the loop who actually reads the case, not one who just clicks approve.

Then there is transparency. Articles 13 and 14 require your privacy notice to name the categories of recipients of personal data. If an AI provider processes customer data for you, that belongs in the notice. If you cannot write that paragraph honestly, you have found your gap.

Before the contract checks, try your own case in the stepper below. It asks the questions in the order a data protection officer would, and it stops at the first real blocker.

Is there a processing agreement with the provider?

Once the data and the purpose check out, the question moves to the tool. When a provider processes personal data on your behalf, you are the controller and the provider is the processor. Article 28 requires a written contract between you, and it sets out what that contract must say. Among other things, the processor may only act on your documented instructions.

That one clause settles the training question. If a provider uses your customers' messages to train its own models, it is pursuing its own purpose, not yours. A processor that does that is not behaving like a processor. So look for two things in the terms you actually signed:

• A data processing agreement between your organisation and the provider. A personal account on the same brand does not count, because your employer is not a party to it.
• An explicit exclusion of training on your inputs and outputs. Search the terms for "train" and "improve", and read every hit.

This is also where the split between tiers shows up. Consumer plans rarely offer a DPA. Business plans usually do. Which vendors offer what, and how to compare them, is the subject of our guide to choosing a GDPR-compliant AI chatbot for business. The difference between consumer and business accounts at the big US vendors is covered in is ChatGPT GDPR compliant.

Where does the data go, and who else sees it?

A processor may use its own subprocessors: a cloud host, a database, a payment provider. Article 28 requires your authorisation for those, which in practice means the provider publishes a list and tells you about changes. Ask for that list with three columns: the party, the processing region, and the legal entity.

The region answers the international transfer question. Chapter V of the GDPR, starting at article 44, only allows personal data to leave the European Economic Area under a transfer mechanism. The common ones are an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies, or standard contractual clauses. If data is processed inside the EU or EEA, you do not need one for that hop.

The entity answers a different question: which governments can compel access. A US parent company can be ordered to hand over data held by its European subsidiary, which is what the CLOUD Act and EU data post unpacks. That is a risk to assess and document, not an automatic ban.

Being honest about our own chain: at Union AI all AI inference runs on infrastructure inside the European Union, prompts and outputs never go to the United States or China, and models are not trained on customer data. But our subprocessor list also shows three parties with a US parent entity, for hosting, database and payments. "No data leaves the EU" would be false, so we do not say it. A hop-by-hop view of what each layer sees is in where your prompts go.

How long is it kept?

Storage limitation, in article 5(1)(e), says you keep personal data no longer than you need it. That applies to the chatbot too. Three places can hold a copy of what you pasted:

The chat history

Most chat tools keep your conversations until you delete them. If a chat contains a customer's complaint with their name in it, that chat is now a record in a system your retention policy probably does not mention. Delete chats with customer data when the task is done, or pick a tool where you can set history to expire.

The provider's logs

Some providers keep prompts for abuse monitoring for a set number of days, even when history is off. That period should be in the DPA. If it is not, ask.

Your own records

Article 30 requires a record of processing activities. Add the AI tool: what data goes in, for which purpose, which provider, which transfer mechanism, which retention period. It is one row in a spreadsheet, and it is the row a regulator asks for first.

What if customer data already went into the wrong tool?

Treat it as a possible personal data breach. The Dutch regulator's notice is explicit: if an employee enters personal data into a chatbot against the organisation's agreements, that is a data breach. Under article 33, you have 72 hours from becoming aware of it to notify your data protection authority, unless the breach is unlikely to result in a risk to people.

What to do, in order:

1. Find out what went in. Which data, about how many people, in which tool and account.
2. Try to delete it. Delete the chat, and ask the provider in writing to delete any copies.
3. Assess the risk. A first name in a harmless question is not the same as a file of addresses or a medical note.
4. Notify if needed. The authority within 72 hours, and the affected customers too when the risk is high.
5. Fix the cause. Usually that means giving people an approved tool, because the reason someone used the free one is that nothing else was available.

That last point is the real lesson from the regulator's cases. Bans do not stop the pasting; they move it to a phone. Why employers block chatbots, and what employees can do instead, is covered in not allowed to use ChatGPT at work.

A one-screen checklist for your team

Print this, or paste it into your handbook next to your AI policy.

Check	GDPR	Pass when
Personal data?	Art. 4(1), recital 26	You stripped identifiers, or you need them for this task
Special category?	Art. 9, 10	None present, or a documented exception plus DPIA
Purpose	Art. 6(1), 6(4)	Same job you collected the data for, or a written compatibility test
Processing agreement	Art. 28	Signed by your organisation, training excluded
Transfers	Art. 44-46	Processed in the EU/EEA, or a named transfer mechanism
Retention	Art. 5(1)(e), 30	You know the period and it is in your records

If every row passes, you are on solid ground. If one row says "don't know", that is your next task, not a reason to give up on AI.

Where a European chat plan fits

A provider that runs inference in the European Union takes the transfer row off the table for the part that sees your prompts, and makes the privacy-notice paragraph shorter. It does nothing for the other five rows. You still decide what goes in and why.

Union AI's chat plan is €13 a month, or €11 a month billed yearly (see pricing), runs on open-weight models on European infrastructure, and comes with a data processing agreement and no training on your data. If you are moving a team over from another tool, the practical steps are in how to switch from ChatGPT. Whatever tool you end up with, the checks above are yours to run. No vendor can run them for you.