AI chatbot for business
What an AI chatbot does and how to set one up well.
Systems & automation · Privacy
GDPR and AI chatbots:
what a Malta business must do.
An AI chatbot handles names, numbers and sometimes much more. That makes it a GDPR question before it is a tech question. Malta Digital builds chatbots, including our WhatsApp chatbot for Malta businesses service, with the privacy work done first, and this guide shows you what that work is.
Free 10-point checkwith a first message to copy
Short answer
GDPR applies as soon as your chatbot handles personal data. Tell people at the start that they are talking to AI and how their messages are used, collect only what the task needs, sign a processor contract with every supplier, set a delete date for chat logs, and keep a person in charge of big decisions. Malta Digital builds GDPR-ready chatbots as part of our WhatsApp chatbot for Malta businesses service.
Key takeaways
- Does GDPR apply to an AI chatbot? Yes, as soon as it handles personal data such as a name, a phone number, a booking or anything a customer types about themselves. Malta’s data protection regulator, the IDPC, says that where AI systems process personal data, the GDPR applies alongside the EU AI Act and takes legal precedence.
- Do I have to tell customers they are chatting with AI? Yes. Article 50 of the EU AI Act has required it since 2 August 2026, unless it is obvious. The GDPR also expects you to explain at the start how their messages are used. One honest line in the first message, plus a link to your privacy notice, covers both.
- Do I need consent to run a chatbot? Usually not for answering questions or handling a booking. Those chats normally rest on taking steps for a contract the person asked for, or on your legitimate interests. You do need consent for marketing messages, and great care with health or other special category data.
The rules
Two laws, one chat window.
A chatbot feels like a small thing: a window that answers questions. But every message a customer types can hold personal data. A name, a phone number, a booking, a child’s age, a symptom. That brings in the GDPR.
Since 2 August 2026, a second law sits on top. EU AI Act Article 50 (AI Act Service Desk) says people must be told they are talking to an AI system, unless it is obvious. Our EU AI Act guide for small businesses covers the rest of that law.
Which one wins if they pull in different directions? Malta’s regulator is clear. The IDPC Malta: Artificial Intelligence page says that where AI systems process personal data, the AI Act applies and the GDPR “takes legal precedence”. The IDPC has also been named a fundamental rights authority under the AI Act for the protection of personal data.
Your customers care. In the Commission’s European Commission: Malta’s 2026 Digital Decade Country Report, privacy and data protection is the top concern Maltese people name about generative AI, at 44%. A chatbot that is open about itself is not just legal. It is how you keep people typing.
The data
Follow the data, stop by stop.
The easiest way to get a chatbot right is to follow one message from start to finish. Most chats pass through five stops. At each stop, one GDPR question needs an answer you can write down.
| Stop | Who runs it | What to keep on file |
|---|---|---|
| The customer types | The customer | Your privacy notice, linked in the chat |
| The chat channel | Website widget or the WhatsApp Business Platform | The supplier’s data processing terms |
| The AI model | An AI model provider | Where it processes data, the transfer safeguard, training switched off |
| Your systems | You: CRM, booking diary, inbox | Which fields the chatbot fills, and who can see them |
| The logs | You and your suppliers | How long each log is kept, and how it is deleted |
That table is most of your record of processing for the chatbot. Keep it with your other GDPR records and update it when you change a supplier.
Lawful basis
Your reason for holding each chat.
The GDPR lets you process personal data only on one of six legal grounds, listed in Article 6 of the GDPR, Regulation (EU) 2016/679 (EUR-Lex). For a chatbot, three come up again and again. Pick the right one for each use and write it down.
| What the chatbot does | Usual basis | Watch out |
|---|---|---|
| Answers a question about prices or hours | Legitimate interests, or no personal data at all | Do not ask for a name you do not need |
| Takes or changes a booking | Steps for a contract the person asked for | Collect only the booking details |
| Sends offers after the chat | Consent | Email and SMS also follow S.L. 586.01; WhatsApp needs an opt-in |
| Handles a symptom or a child’s needs | Special category rules, often explicit consent | Better routed to a person; consider a DPIA |
| Uses chats to improve the bot | Legitimate interests, with a balancing test | Strip names first; never let a supplier train on them by default |
Marketing is where most businesses slip. A chat about a booking does not give you permission to send offers later. Our CRM and GDPR guide explains consent and the soft opt-in for email and SMS in Malta.
Transparency
What to tell people in the first message.
Article 13 of the GDPR says people must be told certain things when you collect their data: who you are, why, the legal basis, who receives it and how long you keep it. The AI Act adds one more line: that they are talking to AI.
You do not need a wall of text in a chat bubble. Put two short lines in the greeting and link the full notice.
| Line | Example | Why |
|---|---|---|
| Who and what | “Hi, I’m the clinic’s AI assistant.” | AI Act Article 50 |
| A way out | “A person can take over at any time.” | Fair, and expected by customers |
| A limit | “Please don’t share health or ID details here.” | Keeps special category data out |
| The notice | “How we use your messages: [link].” | GDPR Article 13 |
Example sceneA Gozo guesthouse adds those four lines to its WhatsApp greeting. Guests still ask about ferries and parking in the same breath. Nobody leaves the chat because of it.
The checker below writes a first message with your business name in it. For a WhatsApp chatbot, Meta’s own rules add an opt-in and a clear route to a person. Our WhatsApp chatbot for Malta businesses page explains those.
Want a chatbot that passes these checks on day one?
Apply now and tell us where customers message you. We will show you the data flow, the first message and the suppliers before anything is built.
Free tool
Check your chatbot in 10 questions.
Answer for the chatbot you already run, or the one you are planning. Every “no” becomes a fix with a plain explanation. Every “not sure” is a question to put to your supplier. You also get a first message you can adapt.
AI chatbot GDPR check: 10 questions
Answer for the chatbot you have or plan. Worked out on your device. Nothing is sent anywhere.
Your result
This check needs JavaScript. Without it: count your “yes” answers. Every “no” is a fix to make before launch, and every “not sure” is a question for your supplier.
A sample dental clinic scores 3 out of 10: it says it is AI and offers a person, but it has no notice in the chat, lets patients type symptoms, has never asked its supplier about training or data location, and keeps every chat forever. That is a normal starting point. All seven fixes can be done before launch.
Suppliers
The contracts behind the chat.
Almost every chatbot uses suppliers: the chat platform, an AI model provider and a host. Each one that handles your customers’ data for you is a processor under Article 28. You need a contract with each, usually their data processing terms.
Then ask three questions of every supplier, in writing.
| Question | Good answer | Red flag |
|---|---|---|
| Where is the data processed and stored? | A named country, with a safeguard if outside the EU | “Our cloud partners, globally” |
| Do you train models on our customers’ chats? | No, and it is in the contract or a setting | “It helps the product improve” |
| How do we delete a person’s chats? | Through the dashboard or an API, within days | “Contact support” |
For data that leaves the EU, Articles 44 to 46 apply. That usually means an adequacy decision for the country, or standard contractual clauses. Your supplier should tell you which one it relies on.
If you want to go deeper, the EDPB Support Pool of Experts: AI Privacy Risks and Mitigations, Large Language Models (April 2025) report was written for data protection authorities by an outside expert, so it is not the EDPB’s official position. It sets out a risk method for systems built on large language models, with a customer-service chatbot as its first worked use case. Its mitigation ideas include limiting access, filtering what goes in and out of the model and keeping logs to a minimum.
Want us to check your chatbot suppliers with you? Apply now for a WhatsApp chatbot
Sensitive cases
Health, children and big decisions.
Three situations need more care. The first is special category data, such as health. A clinic, pharmacy or physio chatbot will be told symptoms whether you ask or not. The second is children. The third is a decision the bot makes on its own that seriously affects someone.
Malta’s regulator publishes its own list of when a Data Protection Impact Assessment (DPIA) is required. The IDPC Malta: Data Protection Impact Assessment, with the Malta list of when one is required page includes “any processing of special categories of personal data and of data concerning vulnerable data subjects, through the use of innovative technologies”. An AI chatbot is a new technology. Patients and children are on that list.
| Situation | What the rules say | What we do |
|---|---|---|
| Health details in a clinic chat | Article 9 special category data; DPIA likely | Steer details to a secure form or a person; DPIA before launch |
| Chats about children | Vulnerable people on the IDPC list | Collect the minimum; adults only in the chat |
| Bot refuses a refund or a booking alone | Article 22 limits fully automated decisions | A person approves anything that matters |
| Staff chat assistant that rates staff | Employee monitoring on the IDPC list | Out of scope unless planned with care |
On decisions, the IDPC has been direct. In its IDPC news: seminar on data protection and AI for technical experts, it said automated decision tools must include safeguards such as a human in the loop to comply with Article 22. A chatbot can collect, sort and suggest. A person should decide.
Retention
How long to keep chat logs.
The GDPR does not give a number of days. It says keep personal data no longer than you need it, which is the storage limitation principle in Article 5. The honest answer is a short, written list you can defend.
| Kind of chat | A sensible period | Reason |
|---|---|---|
| Opening hours, prices, directions | 30 to 90 days | Only useful to improve answers |
| Bookings and changes | As long as the booking record | You may need to show what was agreed |
| Complaints and refunds | Until settled, plus a set period for claims | Ask your adviser for the period |
| Marketing opt-ins | As long as you send, plus proof | You must show when and how they agreed |
These are starting points, not legal advice. Whatever you pick, set it to delete automatically, and make sure you can find all of one person’s chats when they ask to see or delete them.
Malta data
Malta firms use AI. Few plan the privacy.
Malta is ahead on AI. Eurostat’s 2025 survey (Eurostat isoc_eb_ain2 (AI use by activity, 2025)) shows 21.5% of Malta businesses with 10 or more staff use at least one AI technology, against 20.0% across the EU. Fewer use AI that writes or speaks text, at 6.3% against 8.8%. That gap is where chatbots sit, and it is closing.
The striking number is the reason firms hold back. Among businesses that considered AI but did not use it, 28.5% in Malta cited data protection worries, against 52.7% across the EU. Unclear legal rules: 31.2% against 53.6%.
Read that carefully. Malta firms are less put off by privacy. That can mean confidence, or it can mean the question was not asked. A chatbot launched without these checks is the second kind.
Our approach
How we build privacy into a chatbot.
We do the privacy work before the build, because it is cheaper there. Here is the order we follow.
- Map the chats. What customers ask, and what data each answer needs.
- Choose suppliers. Data location, training off, a processor contract for each.
- Write the first message. AI disclosure, a way to a person, a notice link.
- Set the limits. No health or ID details in chat; sensitive cases go to staff.
- Set retention. Delete dates per kind of chat, switched on before launch.
- Test with your team. Real questions, edge cases, the hand-over.
- Hand over the records. The data flow table and settings, for your files.
Access is part of privacy. For a childcare and nanny agency, we built one platform where the office, nannies and parents each see only their own side of a booking, and an audit log records every change. That is the same thinking a chatbot needs: each person sees only what their job needs.
We price each WhatsApp chatbot per project after scoping. When it is part of a custom booking system or CRM, custom systems start from €7,500. We start as soon as the first payment is made. A focused system has its first working version in 2–4 weeks. Bigger systems are live within 2–3 months at most. You own every line of code we build for you.
AI chatbots and business virtual assistants are named in the AI definition of the Digitalise your SME grant, so a larger project may qualify; see our AI grant in Malta page. The funding body decides. Malta Digital has 18 Google reviews from Malta businesses, and we are not lawyers: check your final notice with your adviser.
A few straight answers
What you might be wondering.
Does GDPR apply to an AI chatbot?
Yes, as soon as it handles personal data such as a name, a phone number, a booking or anything a customer types about themselves. Malta’s data protection regulator, the IDPC, says that where AI systems process personal data, the GDPR applies alongside the EU AI Act and takes legal precedence.
Do I have to tell customers they are chatting with AI?
Yes. Article 50 of the EU AI Act has required it since 2 August 2026, unless it is obvious. The GDPR also expects you to explain at the start how their messages are used. One honest line in the first message, plus a link to your privacy notice, covers both.
Do I need consent to run a chatbot?
Usually not for answering questions or handling a booking. Those chats normally rest on taking steps for a contract the person asked for, or on your legitimate interests. You do need consent for marketing messages, and great care with health or other special category data.
Is a WhatsApp chatbot GDPR compliant?
No tool is compliant on its own. A WhatsApp chatbot can be run in a GDPR-friendly way: customers start the chat or opt in, the first message says it is AI, it asks only for what it needs, suppliers sign processor contracts, and chats are deleted on a schedule.
Can my chatbot supplier train its AI on my customers’ chats?
Only if you allow it, and for most businesses you should not. Check the account settings and the contract, turn training off, and keep the proof. Your customers did not expect their messages to train someone else’s model.
Do I need a DPIA for a chatbot?
Not always. The IDPC’s list says a DPIA is required when innovative technology processes special category data or data about vulnerable people, such as patients or children. A clinic or childcare chatbot that takes health or child details should have one. A simple opening-hours bot usually does not.
How long should I keep chatbot conversations?
Only as long as you need them. Many businesses keep routine chats for 30 to 90 days, booking chats as long as the booking record, and complaints until they are settled. Pick periods you can explain and set them to delete automatically.
How much does a GDPR-ready chatbot cost?
Malta Digital prices each WhatsApp chatbot per project after scoping. When it is part of a custom booking system or CRM, custom systems start from €7,500. The privacy work is part of the build, not an extra. We start as soon as the first payment is made. A focused system has its first working version in 2–4 weeks. Bigger systems are live within 2–3 months at most.
Sources
Where these facts come from.
- IDPC Malta: Artificial Intelligence
- IDPC Malta: Data Protection Impact Assessment, with the Malta list of when one is required
- IDPC news: seminar on data protection and AI for technical experts
- EDPB Support Pool of Experts: AI Privacy Risks and Mitigations, Large Language Models (April 2025)
- European Commission: Malta’s 2026 Digital Decade Country Report
- GDPR, Regulation (EU) 2016/679 (EUR-Lex)
- EU AI Act Article 50 (AI Act Service Desk)
- Eurostat isoc_eb_ain2 (AI use by activity, 2025) (read via the Eurostat API on 10 November 2026; the API was unavailable on 11 November)
Keep reading
Related guides.
EU AI Act for small businesses
The AI Act duties that touch a Malta small business.
CRM and GDPR
How to keep customer data in your CRM legal, safe and useful.
A useful first step
Apply for a GDPR-ready chatbot
Tell us where customers message you and what they ask. We reply with a first scope, the data the chatbot needs, and what it would cost.
Step 1 of 3
Apply now for a WhatsApp chatbot
A few quick questions, about a minute. We usually reply within 2–3 hours.