AI chatbot for companies with source references
Internal knowledge search and chatbots built around your content: approved answers or RAG with a language model. T-NEX scopes access, data and implementation.
Learn moreGuides for companies
How can a business assess a chatbot for data protection?
Whether an AI chatbot can be used lawfully depends on the actual processing: what data enters the system, who processes it for which purpose, and who can access it? A supplier name or an EU hosting label does not answer these questions fully. The criteria below help connect your use case with the evidence needed before selection.
In daily work
1. Write down the purpose and data flow
For companies planning an internal knowledge assistant or a publicly accessible service chatbot.
Describe the task the chatbot performs. Separate inputs, source documents, answers, logs and human handover. Contact details in a message, identifiers in a support case and information in an internal document may all be personal data.
For each processing step, assess the purpose and appropriate lawful basis. Limit data to what is necessary and give people understandable information. Consent is not an automatic default solution for every business chatbot.
Overview
2. Assess contractual roles and model use separately
The participants’ actual activities determine their roles. If a supplier processes data under your instructions, that processor relationship needs a contract. If it determines separate purposes for particular processing, assess that role separately. The product label does not decide this.
Record the application, host, model provider and other services involved. In particular, establish whether inputs or outputs may be used for a provider’s own model improvement. Switching training off does not automatically remove logs, retention or other processing.
| Question | Information required |
|---|---|
| Who processes which data? | Legal entities, roles and processing steps |
| Which instructions apply? | Appropriate processor contract and documented configuration |
| Which other suppliers are involved? | Sub-processors and the procedure for changes |
| Are contents used for a separate training purpose? | Contractual usage rules and actual settings |
| How are individual rights supported? | Responsibility, contact route, search, correction and deletion |
Overview
3. Distinguish hosting location from actual access
Document storage, model processing, support and administrative access. An EU region alone does not rule out access by another legal entity outside the European Economic Area. Making personal data available to another controller or processor in a third country can constitute an international transfer.
Assess the applicable transfer mechanism, such as a relevant adequacy decision or appropriate safeguards. When relying on standard contractual clauses, actual circumstances and any necessary supplementary measures matter. The analysis follows the data flow, not simply the nationality of a brand owner.
Overview
4. Test permissions at the answer level
For an internal assistant, access control must cover retrieval and the resulting answer. A document can be protected correctly while a poorly scoped search still exposes its contents through a response.
Test representative cases using different roles: may the person view the document, receive the information and open the citation? Repeat the checks when roles, documents or retrieval change. These are practical applications of risk-appropriate safeguards.
- Check source access and answer content together.
- Restrict administrative access and make changes traceable.
- Keep confidential data out of unapproved test environments.
- Define procedures for access failures and accidental disclosure.
Overview
5. Plan retention and deletion across the process
Give each data store a purpose and a justified retention period. Conversation history, feedback, source documents and technical logs need not be kept for the same duration. Define how relevant information can be located, corrected or deleted.
For practical acceptance, follow a test item through the agreed process: input, storage, retrieval and deletion. Include derived search indexes and backup handling. Document what is removed immediately and what agreed periods or technical limitations remain.
Overview
6. Make a documented decision before use
Bring the use case, participants, data flows, contracts and safeguards together in a reviewable decision. Assess whether the specific risks require a data protection impact assessment. The label chatbot does not replace that evaluation.
You can use this checklist and a process description in a discussion with T-NEX. We discuss the technical implementation and evidence needed. A product page or general checklist does not establish that every individual customer deployment already meets all requirements.
FAQ
Frequently asked questions
Is EU hosting sufficient?
It is one operating characteristic, not complete evidence. Also assess model processing, access by other legal entities, contractual roles, purposes and safeguards.
Does every chatbot need a data processing agreement?
The answer depends on actual roles. Where an external supplier processes personal data on behalf of and under instructions from a controller, that relationship must be governed appropriately. The product label does not resolve the role assessment.
Does switching model training off delete conversation history?
No. Use for training and retention for operations, security or conversation history are separate questions. Check the contract, configuration and deletion functionality.
How can an internal knowledge chatbot be tested practically?
Use test roles with different access rights. Check the source, response and citation, including after access is withdrawn or information is deleted. Record results and known limitations in acceptance documentation.
Is a data protection impact assessment always required?
The chatbot label alone does not answer that question. Assess the actual processing, data, individuals affected and risks. Processing likely to result in high risk requires a data protection impact assessment.
Related options
You may also be interested in these.
AI chatbot costs
Plan business AI chatbot costs across data preparation, integrations, usage, quality checks and ongoing content maintenance. Compare like-for-like proposals.
First version: Updated:
Read articleStandard contractual clauses and DPAs
SCCs for processing in third countries: choosing modules, understanding the DPA relationship and completing the details for software development.
First version: Updated:
Read articleWhich task would you like to solve next?
Bring a concrete task. Together, we will define what the application needs to do.
Discuss your chatbot use case and data flows