Founding offer50% off Starter, Growth or Business for life, first 50 teams. Code FOUNDING50.
UK GDPR & compliance

UK GDPR-compliant AI chatbot: what the law requires and how to run one safely

A practical guide for UK support, operations and compliance teams putting an AI agent in front of customers — with primary sources, how Threadbox handles each requirement and a printable 10-point checklist.

Last updated · Reviewed by James Brown

Not legal advice: This page is practical operational guidance written by the Threadbox team for UK businesses evaluating AI customer support. It is not legal advice. For advice on your specific obligations, consult your Data Protection Officer or a qualified solicitor and refer to the Information Commissioner’s Office (ICO) guidance on AI and data protection and the Data Protection Act 2018 .
The six pillars

What UK GDPR requires when an AI chatbot talks to your customers

When a visitor types into a support widget, sends a WhatsApp message or emails your helpdesk, your business is the Data Controller and your AI support vendor acts as a Data Processor.

Articles 5 & 6 · Lawful basis & purpose limitation

Define what the chatbot processes and why

What UK GDPR expects
Customer support chats process personal data from the first message: names, email addresses, order references, IP addresses and free-text transcripts. You need a documented lawful basis (typically performance of a contract or legitimate interests for customer service) and must not repurpose transcripts for marketing without appropriate consent.
How Threadbox handles it
Your content and transcripts are used solely to serve your workspace. Threadbox never sells personal data and never uses customer conversations to train foundation models.
Article 28 · Processor contracts & sub-processors

Put a written Data Processing Agreement in place

What UK GDPR expects
Under Article 28 of the UK GDPR, a controller must only use processors providing sufficient guarantees and must have a binding written contract setting out the subject matter, duration, security measures, sub-processor rules and deletion obligations.
How Threadbox handles it
Threadbox signs a UK GDPR Data Processing Agreement on request (email hello@threadbox.ai) and publishes its full sub-processor list on the security page.
Articles 13 & 14 · Transparency

Tell visitors they are speaking to an AI agent

What UK GDPR expects
People must be told clearly that they are interacting with an automated assistant, what data is collected, and how to reach a human or read your privacy notice.
How Threadbox handles it
Welcome messages, bot naming, avatar and a link to your privacy policy are configurable per widget, with a visible 'talk to a person' escalation option.
Chapter V (Articles 44–49) · Data residency & transfers

Know where data is stored and where inference runs

What UK GDPR expects
If personal data is transferred outside the UK, you must rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
How Threadbox handles it
Application servers, PostgreSQL databases, embeddings and object storage are hosted in the UK/EU. Model providers (OpenAI, Anthropic, Google) are called via enterprise APIs under zero-retention terms.
Article 22 · Automated decision-making

Keep humans in the loop for high-stakes decisions

What UK GDPR expects
Article 22 restricts solely automated decisions that produce legal or similarly significant effects on an individual (such as credit, eligibility, employment screening or contested claims).
How Threadbox handles it
Escalation rules trigger on keywords, negative sentiment, repeated fallbacks or tool calls, pausing the AI and routing sensitive threads to a human in Threads.
Articles 5(1)(c), 5(1)(e) & 15–21 · Minimisation, retention & rights

Limit retention and answer access or erasure requests

What UK GDPR expects
Personal data must be adequate, relevant, limited to what is necessary and kept no longer than needed. Individuals can exercise rights of access (SAR), rectification, erasure and objection.
How Threadbox handles it
Workspace owners can configure automatic retention policies (30 to 3,650 days, delete or anonymise) and export or erase a visitor's conversations in one action.
Printable checklist

10-point UK GDPR AI chatbot launch checklist

Use this checklist with your DPO or procurement lead before switching on any customer-facing AI agent. Print this page (Ctrl+P / Cmd+P) for a clean compliance copy.

Request our DPA
  • Map the personal data your chatbot will see (contact fields, order lookups, free-text messages and special-category risks).
  • Document your UK GDPR Article 6 lawful basis for support conversations in your Record of Processing Activities (ROPA).
  • Sign an Article 28 Data Processing Agreement (DPA) with your chatbot vendor before connecting live customer channels.
  • Review the vendor's published sub-processor list (hosting, foundation model APIs, email delivery) and regions.
  • Confirm model providers are called under zero-data-retention API terms and never train foundation models on your chats.
  • Verify UK/EU data residency for databases, vector embeddings, file uploads and backups, plus transfer safeguards where needed.
  • Update your website privacy notice and widget welcome message so visitors know they are chatting with an AI agent.
  • Configure blocked topics and escalation rules so medical, legal, financial-hardship or high-risk queries go straight to a person.
  • Set an automatic conversation retention schedule (for example 90, 180 or 365 days) to anonymise or delete old transcripts.
  • Test your Subject Access Request (export) and Right to Erasure (delete/anonymise) workflow in the dashboard before launch.
UK/EU Kubernetes & database hosting
TLS 1.2+ in transit, AES-256 at rest
Companies House no. 00838986
Architecture

Why deterministic lookups and guardrails matter for data protection

Data protection is not only about where servers sit; it is also about accuracy (Article 5(1)(d)) and data minimisation (Article 5(1)(c)). If an AI chatbot guesses an order status or exposes one customer’s details to another, you have both a customer-service failure and a compliance incident.

Threadbox separates general knowledge from personal lookups:

  • Public knowledge sources (your website pages, help centre guides and policy PDFs) are chunked and embedded in your workspace index in the UK/EU. They contain no personal customer records.
  • Deterministic regex webhooks and scoped API actions fetch live order, consignment or booking status only when triggered, returning only the fields your endpoint chooses to expose.
  • AI guardrails enforce blocked topics, prompt-injection detection and system-prompt leak checks on every turn, while escalation rules hand sensitive or regulated conversations straight to your team in Threads.

For a deeper dive into our infrastructure and sub-processor list, visit the Security & trust page or read our blog post on the practical UK GDPR chatbot checklist.

Zero-retention model APIs

OpenAI, Anthropic and Google are called under enterprise API terms that prohibit training on or retaining your prompts.

Role-based access & SSO

Owner, admin, agent, contributor and viewer roles, plus SAML/OIDC SSO, SCIM and IP allow-lists on Enterprise.

Self-serve SAR & erasure

Export a customer’s full conversation history or anonymise/delete it across threads and contacts in one click.

FAQ

UK GDPR & AI chatbot questions

Yes. The UK GDPR and Data Protection Act 2018 do not ban AI chatbots, but they apply the same data-protection principles as to any customer system: lawful basis, transparency, data minimisation, security, Article 28 processor contracts, international transfer rules and individual rights.

Related UK compliance & product pages