Data protection, GDPR and more: What will be important in 2026
Parallel to advancing technological developments, the importance of data protection and data security continues to grow. Since the European General Data Protection Regulation (GDPR) came into force in 2016, uniform standards for the handling of personal data have applied in Europe, which website operators, online shops and companies must comply with. Compliance with data protection regulations is therefore not a nice-to-have for European companies, but a clear must-have. The following requirements are mandatory under the GDPR:
- Consent and transparency: Active, informed consent prior to data processing and identification of bot vs. human are mandatory.
- Server location & data hosting: The server must be located in Germany/the EU ("made in Germany"); transfers to third countries without a level of protection are not permitted.
- Data processing agreement (DPA): The agreement must be concluded to regulate responsibilities and obligations.
- Technical and organisational measures (TOMs): e.g. for end-to-end encryption, access control, logging, security audits
- Ensuring the rights of data subjects: Information, deletion and data portability are consumer rights; the right to object must be implemented.
- Data minimisation and storage periods: Only necessary data may be collected and automatic deletion after defined periods must be ensured.
- AI training and data use: It must be clearly stated whether chat data is used for training purposes. Opt-out options must also be offered.
The regulations create a legal framework for everyone and protect consumers from data misuse, identity theft and other risks. This is an ongoing process, as companies are constantly introducing new products, processes and tools. As a rule, most companies therefore have a data protection officer who is responsible for ensuring compliance with data protection regulations.
Laws and regulations for AI chatbots
When using AI chatbots, companies must make data processing transparent (GDPR). Consent to data processing is required under the TDDDG if cookies or tracking technologies that are not technically necessary are used. If an AI chatbot appears human-like or is not clearly recognisable as AI, the EU AI Act stipulates a clear labelling requirement. The DSA represents an additional level of responsibility for AI companies.
Here is an overview of the most important regulations in 2026:
Important for businesses: By August 2026, all chatbots in use must meet the transparency requirements of the AI Act and be GDPR-compliant. The laws are becoming stricter due to AI-specific interpretations; for example, it must be clear to users that they are interacting with AI.
Data protection trends
The demand for data localisation and data control is fundamentally increasing. Even with chatbots, data may only be processed and used with consent, and only the absolutely necessary data. Chatbots are increasingly being used and data is collected directly and voluntarily from customers. This is also referred to as "zero-party data". From a data protection perspective, this is significantly more secure than tracking, for example. Purpose limitation stipulates that data may only be used for the specific purpose for which the user has explicitly given their consent. Furthermore, systems must automatically delete data after prescribed periods of time. One trend in chatbots is towards context-based anonymisation in order to protect privacy while offering comprehensive functionality.
In general, it will be important for companies in 2026 to bring together data protection, AI governance and cybersecurity and no longer view them as separate silos. Although procedural GDPR changes and new requirements for security mechanisms pose challenges for companies, data protection is above all a trust bonus for customers and thus a direct competitive advantage.
Using chatbots in compliance with the GDPR: The 7 most important requirements
Data protection and chatbots are closely linked, as a bot conducts a large number of conversations with people every day and therefore processes large amounts of data.
The scope of personal information about users that the chatbot has access to varies depending on the chatbot's area of application. The information processed may include names, contact details, preferences and even personal problems or concerns. It is therefore crucial that companies ensure that their chatbots comply with European and British data protection regulations and respect the privacy of users.
Requirement 1: Don't forget the right to be forgotten
An important criterion for chatbot providers and companies that use them to be GDPR-compliant is to guarantee the right to be forgotten. According to this, all users have the right to request the deletion of all personal data about them. If a user expresses this wish, the provider must comply with this request and delete the user data.
With moinAI, GDPR-compliant conversation management is transparent and individually configurable, giving you full control and accountability at all times. The storage period for AI chatbot conversations can be defined individually. Periods ranging from never to 1 year are possible. From a data protection perspective, a short storage period is recommended as this supports the principle of data minimisation.
Requirement 2: Guarantee the right to data access
Users have the fundamental right to request information from the respective service provider about the data stored about themselves.
Requirement 3: Ensuring the right to correction and supplementation
In addition to the right to be forgotten and the right to data access, users have the right to correction and supplementation. This means that companies must ensure that users can change their data, such as their address or telephone number. The chatbot can help here, for example by acting as the interface through which a user communicates to the company that certain data in the system should be changed.
Requirement 4: Obtain consent
Before a company can store and pass on user data, it must obtain the consent of the users via an opt-in procedure. Examples of this include confirming cookies, subscribing to a newsletter or downloading documents. An opt-in procedure can also be used within a chatbot, e.g. by displaying a data protection notice before the conversation begins. Whether such a notice is necessary depends on the data protection classification.
In the following example, consent for data processing is obtained before the chatbot is even used. By linking directly to the privacy policy, a classification under data protection law has been provided.
Important to know: A notice should only be added to the start screen if it is required in accordance with data protection regulations. This is because the notice represents a hurdle to using the chat and is therefore recommended during use of the chat widget.
Requirement 5: Conclude a contract for order processing
A contract for order processing (AVV) should always be used when a company passes on personal data to third parties on behalf of others or processes or uses this data. It is therefore best to conclude a data protection-compliant AVV with the chatbot provider of your choice in order to ensure that your users' data is handled properly.
Requirement No. 6: Provide a complete privacy policy
Another important point to consider when choosing the right chatbot provider is an up-to-date, easily accessible and complete privacy policy. Website operators must ensure that the policy is easy to understand and can be viewed from any subpage of the website with just one click.
H3: Requirement 7: Select Germany as the server location
In accordance with the provisions of European data protection law, Art. 45 GDPR, no personal data from the EU may be transferred to unsafe third countries, but only to a third country with a level of protection equivalent to that of the EU. All EU member states as well as Iceland, Liechtenstein and Norway (EEA) are automatically considered safe. Other safe third countries are as follows:
- Andorra
- Argentina
- Faroe Islands
- Guernsey
- Isle of Man
- Israel (restricted)
- Japan (private sector only)
- Jersey
- Canada (commercial organisations only)
- New Zealand
- Republic of Korea (South Korea)
- Switzerland
- United Kingdom (UK)
- Uruguay
If no decision has been made, other safeguards such as standard data protection clauses (SCCs) or binding corporate rules must be used. Countries such as the USA, Russia and China are considered unsafe third countries. If you are looking for a GDPR-compliant chatbot provider, they must have servers located either in the EU, the European Economic Area or in one of the aforementioned safe third countries.
All 7 requirements at a glance
Data protection and ChatGPT – what to expect in 2026
ChatGPT triggered a veritable AI wave in 2022 and got many people excited about chatbots. However, after the initial ChatGPT hype, critical voices increasingly began to express data protection concerns.
ChatGPT is classified under the EU AI Regulation (EU AI Act) as a general-purpose AI (GPAI) system. This means that ChatGPT can be used in a variety of ways as a model to perform tasks in companies with the help of generic AI and a self-learning model base. However, this also means that the AI is subject to specific transparency requirements and rules. Newer GPT versions may be classified as models with systemic risk, i.e. models with the potential for widespread negative impacts. Other examples in this category include DALL-E, Google BERT and Claude.
The AI Regulation also stipulates the following additional obligations:
- Risk assessment and mitigation: active identification, assessment and minimisation.
- Adversarial testing for assessment: based on security testing.
- Incident reporting: immediate reporting of serious incidents.
- Cybersecurity requirements: adequate security measures necessary.
The following three points in particular illustrate that data protection, GDPR and ChatGPT do not go well together:
Critical legal basis for data processing
According to Article 6(1) of the General Data Protection Regulation, data processing is only permissible if there is a corresponding legal basis, i.e. specific contractual obligations must exist. Otherwise, the consent of the data subjects is required for data processing. OpenAI offers a data processing agreement (DPA) for ChatGPT Business, ChatGPT Enterprise and the API that supports GDPR compliance. However, no DPA is available for ChatGPT Free and DALL-E as consumer services, so companies should use business accounts, as otherwise there is no clear contractual basis for data processing.
Processing of data in unsafe third countries
In order to be considered GDPR-compliant, ChatGPT would have to process data either in the EU or the European Economic Area or in third countries classified as safe by the EU. OpenAI is a US company that manages its servers in the United States. American data regulations apply there, which are currently not compatible with European regulations. This is because the CLOUD Act (Clarifying Lawful Overseas Use of Data Act) obliges US companies to transfer data, and confidentiality cannot be guaranteed. For EU customers, OpenAI uses standard contractual clauses (SCCs) as a transfer mechanism. However, data protection authorities are questioning whether these transfers offer sufficient protection for EU citizens.
Lack of transparency regarding data processing
Article 13 of the European Data Protection Regulation stipulates that companies must inform users about how their data is handled, i.e. what data is processed and in what context it may be accessed. Lack of or insufficient transparency in data processing is one of the main criticisms levelled at ChatGPT by data protectionists. The following points in particular are criticised:
- Use of data for model training: The models are further developed using user prompts. In the paid version, the opt-out function can be used independently to deactivate "Improve the model for everyone".
- Insufficient information about data purposes: How and why data is collected and processed, and whether data is used beyond its original purpose, is not always clearly explained.
- Deletion and information: Compliance with information obligations under the GDPR is unclear due to the complexity of AI systems.
These allegations make it considerably more difficult to use ChatGPT in a legally compliant manner in a business context. OpenAI is working on improving data protection and adapting its systems to the European market. The clear recommendation for safe use is therefore: do not enter any personal data or company documents, deactivate "Improve model" in the settings and, if necessary, use enterprise/API licences for contracts.
In the article "ChatGPT in customer service: Does AI bring real added value?", we show in detail the challenges that exist when using it in customer service.
ChatGPT? Practical, but not suitable for customer communication
Companies that choose chatbot providers such as ChatGPT for customer communication risk not only fines for violating the GDPR, but also damage to their image due to so-called "chatbot fails". These occur primarily when generative AI offers no control options and hallucinates – i.e. plays back fictitious, false or inappropriate content.
For more information on AI hallucinations and how to prevent them, see our article "The 6 biggest chatbot fails and tips on how to avoid them".
Conclusion: Play it safe with a German AI chatbot provider
A closer look at the GDPR and the analysis of ChatGPT in this context show that you need to be careful when choosing a chatbot provider. GDPR-compliant providers take consumer rights seriously, protect them, offer complete transparency regarding data handling and ensure that data is processed in secure locations such as Germany.
Would you like to see an example that illustrates how data protection and AI chatbots are not opposites, but can be combined effectively? moinAI not only has years of industry experience, but also offers AI made in Hamburg. As part of the knowledge check, the content of the resources used to generate responses is reviewed to ensure that the output provided to users is not hallucinatory, but reliable and accurate:
Find out everything you need to know about how moinAI implements the requirements of the GDPR on our data privacy page.
This article is provided for informational purposes only and is not a substitute for legal advice.
[[CTA headline="GDPR-compliant? With moinAI, you can be sure!" subline="Discover AI made in Germany. Enter your URL, get your first automation ideas and see for yourself." button="Try it now"]]
