Eight questions, one owner each.
| # | Question | Where it comes from |
|---|---|---|
| 1 | What is our lawful basis for each type of data the agent touches (contract, legitimate interest, consent)? | GDPR Art. 6 |
| 2 | Which suppliers process data for us (AI model, hosting, WhatsApp, CRM), and do we have a processor agreement with each? | GDPR Art. 28 |
| 3 | Does data leave the EU? If so, on what transfer basis? | GDPR Chapter V |
| 4 | Is the processing likely to be high-risk, so that a DPIA is required? | GDPR Art. 35; the AP's DPIA list |
| 5 | Does our privacy notice explain the agent, in plain language? | GDPR Art. 13–14 |
| 6 | How long do we keep conversations and logs, and who deletes them? | GDPR Art. 5(1)(e) |
| 7 | Can a customer always reach a person, and does any decision with legal or similar effect get human review? | GDPR Art. 22; AP/ACM statement Oct 2025 |
| 8 | What may staff paste into public AI tools, and is that written down? | AP warnings about data leaks via chatbots |
A checklist to organise the conversation with your privacy officer or lawyer, not a substitute for it.
The three gaps we see most.
Build it so the answers are easy.
Conversation logs and the agent itself on EU infrastructure, with model providers that offer EU processing where possible.
The agent reads one mailbox or one calendar, not the whole tenant.
Logs kept as long as you need for quality and disputes, then deleted automatically.
Every channel has a visible way to reach a person, logged when used.
The agent introduces itself as an assistant, which also covers the EU AI Act's transparency rule from 2 August 2026.
Where this comes from.
- Regulation (EU) 2016/679 (GDPR / AVG), EUR-Lex
- EDPB: Data protection guide for small business
- Ondernemersplein (Dutch government): carrying out a DPIA
- NJB: AP and ACM say customer contact may not run only through an AI chatbot (2 October 2025)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
Not legal advice.
This guide is general information, checked against the sources listed, and not legal advice. Rules change; check the current text or ask a lawyer before you rely on it. Checked November 2026.
Common questions.
Do we always need a DPIA for an AI agent?
Not always. A DPIA is required when processing is likely to result in a high risk, for example large-scale processing of sensitive data or systematic monitoring. A booking agent with minimal data often does not need one; a recruitment screening agent often does. Record why you decided either way.
Can we use a US-based AI model?
Possibly, with a valid transfer basis and a processor agreement. Many providers now offer EU data processing, which simplifies the question. We set out the options per supplier in the Blueprint.
Is a chatbot a decision under Article 22?
Answering questions or booking slots is not. Rejecting a customer, a loan or a candidate automatically can be. Keep a person in those decisions.
Who supervises this in the Netherlands?
The Autoriteit Persoonsgegevens for privacy. The ACM supervises consumer-protection and telemarketing rules, and both regulators have said they are watching chatbot use in customer contact.
Want this in your business?
Tell us how you work today. We'll tell you honestly what AI can take off your team's plate, what it costs, and whether we are the right fit.