For a small support team, AI customer service and GDPR compliance come down to a few questions answered before the model sees any conversation. Which chat data is sent to the provider? Who processes it, and on what terms? Where are the servers, and does the data leave the European Economic Area? Who in your business approves the tool, and where is that decision recorded?
This checklist draws on European data protection guidance for organisations using ready-made AI tools and applies it to customer chat, with examples. In the UK, the UK GDPR and ICO guidance apply instead; the questions are similar, but transfer rules differ. It is not legal advice: confirm the lawful basis and any international transfer with a lawyer or your data protection officer.
AI customer service and the GDPR: start with one use case
Assess each use of a tool separately, because the same product carries a different risk in customer support than it does in recruitment. For chat, describe one concrete use, for example: “the model suggests a draft reply to the operator for delivery questions.” That single sentence shows which data the tool needs and whether its output affects the customer's situation.
A report published by the EDPB in April 2025 on privacy risks in large language models includes a customer service chatbot use case. Written by an external expert, it is not an official EDPB position and does not assess any particular tool.
Split your questions into two kinds: what the tool actually does, and what the law requires. A blank answer is not a failure, it is a task: write down what needs checking, who will do it and by when. Keep the completed list, because it shows that your business looked at these issues before going live.
Which conversation data reaches the model
A chat conversation almost always contains personal data, even without a surname; the wider picture is covered in our guide to live chat and the GDPR. The narrower question here is what the tool sends to the model provider each time it generates text. Get that list in writing.
Scroll the table sideways to see all columns.
| What reaches the model | Example in a fictional shop | Question to ask |
|---|---|---|
| The current conversation | “Parcel 4821 never arrived, I live in Dublin” | Is the whole thread sent, or only the part that is needed? |
| Knowledge base extracts | Delivery terms and a carrier table | Do the sources contain data about specific customers? |
| Assistant instructions | Tone of voice and topics to hand over | Do the instructions include staff details? |
| Sensitive data typed by a customer | An illness given as the reason for a return | What does the team do once such a message is in the chat? |
You do not control what customers write. Health data needs a special legal basis, so decide in advance whether AI should run in conversation types where such details come up regularly. Choose knowledge sources using our guide on what data belongs in a chatbot knowledge base, and keep documents with customer data out of it.
Who acts as the processor
Usually you are the controller and your chat vendor is a processor under an Article 28 GDPR agreement. AI adds a second link: the model provider your chat vendor relies on. Ask who that is, whether it acts as a sub-processor and where this is written down. The EDPB expert report notes that a model provider that keeps data for its own purposes, such as improving its model, becomes a controller for that processing.
So check three things in the terms: whether your inputs may be used for training, whether you can switch that off, and how long the provider stores requests. Note the date you read each document, because terms change. How much access the assistant itself gets to your business systems is a separate question, covered in our guide to AI agent permissions.
Where the servers are and whether data leaves the EEA
The processing location appears in the processing agreement, privacy policy and sub-processor list. Record where the model provider operates, not just where your chat vendor is based. If data leaves the EEA, Chapter V of the GDPR (Articles 44 to 49) applies: you need a Commission adequacy decision or another safeguard listed there, such as standard contractual clauses.
The European Commission's list of adequacy decisions includes, among others, Japan, Switzerland, the United Kingdom and the United States for organisations under the Data Privacy Framework; China is not on it. The list does not say whether a specific transfer is lawful, only whether it can rely on a Commission decision.
This point also changes the size of the job. Once conversation data goes to a country without an adequacy decision, a short checklist is no longer enough and you will need specialist support to assess the transfer.
Who in your business approves the tool
Sending conversation content to a model provider is a business decision, not one for whichever operator happens to have a long queue. Name one person who approves the tool and another who checks from time to time that nothing has changed.
- Describe the use case.One sentence on what AI does in chat and whether customers see its replies or only operators do.
- Collect the vendor documents.Processing agreement, sub-processor list, model provider details and data location.
- Settle the basis and transfer.Confirm the lawful basis and transfer safeguards with a lawyer or data protection officer.
- Approve and record.The responsible person approves the tool, noting the date and the document versions they read.
- Schedule a review.Set a recheck date; vendors change models and teams change habits.
Without an approved tool, the need moves to personal accounts. Our guide to shadow AI in customer support explains how to prevent that.
How these questions apply to Meet AI
In Meet AI, the model provider is DeepSeek, the Chinese company Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Each generation sends it the current conversation with necessary earlier context, selected knowledge base extracts and the assistant's instructions. Installation is manual, and an administrator must accept a versioned notice about this provider and the transfer of conversation content. As the Meetlead privacy policy states, a business using Meet AI should name DeepSeek in its own privacy notice and ensure a lawful basis and transfer safeguards.
The default mode is Copilot: customers do not see the AI assistant, and a suggestion never sends itself. Conversation content still goes to the model provider each time a suggestion is generated, so the approval covers this mode too. The data goes to a company outside the EEA, so a short checklist alone is not enough here. Knowledge is isolated per website, and removing a source takes effect immediately. Meetlead does not make your deployment GDPR compliant for you.
What to record before AI sees its first conversation
Some items cannot wait. Before the tool touches customer data, you need an agreement with the vendor, a lawful basis, a notice for the people concerned and a clear answer on where the data is stored. Staff training and input rules can be completed in parallel, each with its own deadline.
- A description of how AI is used in chat and whether customers or only operators see its replies.
- A list of the data sent to the model in a single generation.
- The processing agreement, the model provider's name and the list of sub-processors.
- The processing country and the transfer mechanism for anything leaving the EEA.
- An entry in your record of processing (Article 30) and a decision on whether a DPIA is needed (Article 35).
- An updated customer privacy notice (Article 13) naming the model provider, plus a named reviewer.
When a customer asks about their data, these records show where it went; see our guide to handling a data access request. If the assistant will reply to customers without an operator, our guide to AI chatbot disclosure covers how to label the conversation.
Questions about AI and the GDPR in support
Does a mode where AI only suggests replies to operators exempt me from these questions? No. Customers do not see the assistant, but their messages still reach the model provider when a draft is generated. A human check lowers the risk of a wrong answer, not the amount of data leaving your system.
Does a completed checklist mean my deployment complies with the GDPR? No. A checklist does not replace a risk analysis or a data protection impact assessment and does not settle compliance on its own. It shows you asked the right questions and lists the tasks to close before real conversations start.
