An AI chatbot GDPR compliance checklist used to mean a privacy link and a cookie banner. In 2026 it also has to cover the EU AI Act's chatbot disclosure duty, which applies from 2 August 2026, plus data protection laws across the Gulf and wider MENA, Turkey, India, Brazil and the state-by-state picture in the United States. This guide gives you 10 practical steps, a breach-deadline table by country and a clear view of where Iraq and the Kurdistan Region stand.

This checklist is general information, not legal advice; consult a qualified lawyer in each jurisdiction where you operate.

Key Takeaways

The EU AI Act requires chatbots to disclose that they are AI, unless it is obvious. Article 50(1) has applied since 2 August 2026, and the July 2026 Digital Omnibus did not delay it.
Most regulators run a 72-hour breach clock, but not all. GDPR, Saudi PDPL rules, the KVKK Board, Egypt, Bahrain, Oman and Jordan run on 72 hours, and ADGM on "without undue delay and, where feasible, not later than 72 hours"; Kuwait gives licensed providers 24, DIFC asks only for "as soon as practicable", and Brazil's ANPD requires 3 business days. In the US there is no single deadline — breach notice comes from each state's separate breach statute, and California's is 30 calendar days from discovery to affected residents.
GDPR Article 28(3) requires a binding contract (a DPA) with every processor, which usually includes your inbox platform and AI model provider.
Iraq has no comprehensive private-sector data protection law in force, and neither does the Kurdistan Region, so GDPR-level practice is a sensible baseline.
An AI auto-reply tool must read messages to answer them, so access control, retention limits and encrypted credentials matter as much as encryption in transit.

Who needs an AI chatbot GDPR compliance checklist in 2026

A GDPR compliant chatbot processes personal data on a lawful basis, tells people what happens to their data, keeps it secure and lets them exercise their rights. A business selling on WhatsApp, Instagram or Telegram usually answers to local laws too:

EU: GDPR (applied since 25 May 2018) and AI Act Article 50. Serving people in the EU from outside it? Ask counsel whether GDPR applies.
United States: no single federal privacy law. Duties are mostly state-level, led by California's CCPA/CPRA, plus TCPA consent for automated marketing calls and texts and state bot-disclosure rules such as Maine's.
Saudi Arabia: the Saudi PDPL, whose grace period ended on 14 September 2024. SDAIA regulates it, including processing abroad of data about people located in Saudi Arabia.
UAE (federal): Decree-Law No. 45 of 2021, in force since January 2022, with its Executive Regulations still unpublished.
DIFC: Law No. 5 of 2020; notify processing to the Commissioner annually, and Article 10's rules on autonomous systems cover chatbots.
ADGM: Data Protection Regulations 2021; register with the Office of Data Protection before processing, and renew annually.
Qatar: Law No. 13 of 2016, supervised by the NCSA; explicit consent, plus permission for data of a special nature.
Bahrain: Law No. 30 of 2018; transfers abroad need the PDPA's approved list, its authorisation or another ground.
Kuwait: CITRA's regulation, narrowed in 2024 to licensed telecom and internet providers, so most businesses sit outside it.
Oman: Royal Decree No. 6/2022, enforceable since 5 February 2026; consent-first, with no legitimate-interest basis.
Jordan: Law No. 24 of 2023, applicable since March 2025; prior consent, and consent again to transfer abroad.
Morocco: Law No. 09-08; declare processing to the CNDP first, and get CNDP authorisation to transfer abroad.
Egypt: Law 151/2020; its Executive Regulations (Decree No. 816 of 2025) allow until around early November 2026 to comply.
Turkey: KVKK (Law No. 6698), amended by Law 7499 from 1 June 2024.
India: the DPDP Act 2023; Rules notified in November 2025, most substantive duties from about May 2027.
Brazil: the LGPD (Law 13.709/2018), enforced by the ANPD.

AI chatbot compliance in the United States: CCPA, TCPA and bot disclosure

General information, not legal advice. Whether any of these laws applies turns on your revenue, record counts, sector and data types — check with counsel.

Published counts of US state privacy laws differ by methodology: about 20 are in force and 24 enacted as of September 2026.

California's CCPA, as amended by the CPRA, applies to a for-profit business that does business in California, collects residents' personal information and clears one of three thresholds: global annual gross revenue over $26,625,000 (the figure effective 1 January 2025); buying, selling or sharing the personal information of 100,000 or more California consumers or households; or 50% or more of revenue from selling or sharing personal information. California grants six rights: know, delete, correct, opt out of sale and sharing, limit the use of sensitive personal information, and non-discrimination. Other states share a common core — a privacy notice and opt-outs for targeted advertising, sale and certain profiling — and most add opt-in consent for sensitive data, which free-text chat cannot pre-classify.

Contracts are the sharpest mechanic: under the CCPA regulations (§7051(c)) a vendor without a compliant service-provider contract is not a service provider, and disclosing personal information to it may be considered a sale or sharing. About a dozen states also require a universal opt-out signal to be honored on your widget's host page, not on WhatsApp, Instagram or Telegram; Global Privacy Control is recognized in California, Colorado and Connecticut, and the list shifts, so verify it.

Sector rules sit on top: HIPAA where your customer is a covered entity and the chat carries health data — Meta and Telegram do not sign business associate agreements for standard business messaging, so protected health information cannot go through those channels — plus the GLBA Safeguards Rule for non-bank financial firms and COPPA for under-13 data. Under FTC Act Section 5, the privacy and security claims you publish have to be true.

Outbound marketing is separate. The TCPA requires prior express written consent for marketing calls and texts to US wireless numbers sent with an autodialer or prerecorded voice, and statutory damages run $500 per violating call or text, up to $1,500 for willful or knowing violations, generally per message. Revocation can arrive by any reasonable means and must be honored within 10 business days. Whether the TCPA reaches internet-routed WhatsApp messages is unsettled, so treat written opt-in as a prudent baseline rather than a settled rule; Meta's WhatsApp Business Messaging Policy requires opt-in anyway.

Bot disclosure is state-level too. Maine's chatbot law (10 M.R.S. §1500-DD), in force since 24 September 2025, is the broadest and reaches ordinary sales and support bots; Utah requires disclosure when the consumer asks, and proactively in high-risk interactions such as those collecting health or financial data. California's B.O.T. Act is narrower: intent to mislead, public-facing platforms with 10 million or more unique monthly US visitors, and clear disclosure as a safe harbour.

Step 1: Map the personal data your chatbot collects and where it flows

Data mapping means listing every piece of personal data the bot touches, where it is stored and who receives it. For each channel, record:

What customers send: names, phone numbers, emails, addresses, order details, photos and voice notes.
What you store: conversation history, contact profiles and AI prompt logs.
What connects the systems: channel access tokens, AI provider API keys and webhook secrets.
Where data goes: the messaging platform, your inbox provider, the AI model provider and any CRM or payment tool.

Note each vendor's retention too. Meta says it acts as a data processor for WhatsApp Cloud API and keeps Cloud API messages for at most 30 days (Meta developer docs). See our Cloud API vs Business App comparison.

Step 2: Choose a lawful basis and collect consent where required

GDPR Article 6 lists the lawful bases for processing. Pick one per purpose, not per tool:

Answering order or support questions is one purpose.
Marketing broadcasts and follow-ups are a separate purpose; check whether they need separate consent.
Reusing chats to improve your AI is another purpose; do not bundle it silently.

Write the basis next to each purpose in your data map and keep proof of any consent.

Step 3: Tell users they are talking to an AI (EU AI Act Article 50)

Under EU AI Act Article 50(1), an AI system that interacts with people must tell them they are dealing with AI, clearly and from the first interaction, unless it is already obvious. The duty has applied since 2 August 2026, with fines of up to EUR 15 million or 3% of worldwide turnover, per the European Commission's Article 50 FAQ. The Digital Omnibus on AI, in force since 27 July 2026, did not delay it. Ask counsel how the duty applies to your setup, and check that your chatbot tool shows the disclosure.

Put a one-line disclosure in the bot's first reply in every DM thread, such as "Hi, I'm the AI assistant for [Brand]."
Link a privacy notice that gives the information GDPR Article 13 requires when you collect data from people.
Some US states ask for the same thing: Maine since 24 September 2025, and Utah when a consumer asks or in a high-risk interaction.

Step 4: Minimize the data the bot collects, stores and sends to AI models

Data minimization means collecting only what the task needs. Less data means less to secure, delete and report.

Do not ask for ID numbers or dates of birth to answer delivery or opening-hours questions.
Tell customers never to send card numbers or passwords in chat, and have the bot refuse them.
Send the AI model only the context it needs, not whole customer records.
Read your AI provider's terms on whether API data is used for training.
Offer a human handoff for complaints, refunds or any decision with a real effect on the customer.

Step 5: Encrypt credentials, tokens and customer PII in transit and at rest

GDPR Article 32(1)(a) names pseudonymisation and encryption as security measures. Under GDPR Article 34(3)(a), you need not notify individuals if encryption made breached data unintelligible. You may still need to notify the regulator under Article 33.

Use HTTPS/TLS for every API call and webhook.
Encrypt channel access tokens, AI API keys and webhook secrets at the application level, with the key kept apart from the database, so a leaked database dump does not hand over your WhatsApp or Instagram account.
Encrypt high-risk contact fields such as phone numbers and addresses.

Know the limit: a server that writes AI replies must read message text, so Steps 6 and 7 matter as much as encryption.

Step 6: Enforce role-based access and keep audit logs

Role-based access control (RBAC) gives each person only the permissions their job needs:

Frontline staff get conversations and contacts, not billing, AI settings or API keys.
Read-only users see only what they need and cannot change it.
Remove access the day someone leaves, and rotate any keys they could see.
Log who changed sensitive settings.

India's DPDP Rule 6 lists keeping logs for one year among its security safeguards. Ask each vendor in your stack what staff-access controls it operates and how access is recorded, and keep the answers with your data map.

Step 7: Set retention periods and handle deletion and access requests

GDPR Article 17 gives people the right to erasure, so you need a way to find and remove one person's data across systems.

Define a retention period per data type, such as open conversations, closed conversations and marketing contacts.
Delete or anonymize data when that period ends; automating it is good practice.
Build a request workflow: verify identity, search the inbox, CRM, AI logs and exports, then act and record it.
Track the response deadline in each law you answer to. In India, Data Fiduciaries must answer rights requests within 90 days once the substantive DPDP Rules apply (about May 2027). In California, verifiable requests get 45 days, extendable once.

If you connect Facebook or Instagram, check how your inbox provider handles Meta's data deletion requests.

Step 8: Sign a DPA with every processor and control cross-border transfers

A data processing agreement (DPA) is the binding contract GDPR Article 28(3) requires between you and each processor that handles personal data for you. For an AI chatbot, that usually means the inbox platform, the AI model provider and the messaging API provider. Check sub-processors, AI training use, deletion when the contract ends and how fast the vendor must report a breach to you. The US turns the same idea into a condition — see the CCPA §7051(c) service-provider rule above.

Transfers need attention too. Since Turkey's Law 7499, transfers abroad need an adequacy decision, appropriate safeguards such as a Board standard contract, or a narrow exception. The Board has published no adequacy list, and the exceptions cover incidental, non-recurring transfers only, so they cannot carry a continuous chatbot pipeline: plan on the Board's standard contract, and check the notification steps it requires. Hosting outside Saudi Arabia does not take you out of the Saudi PDPL's scope if you process data about people located there, and Saudi transfers need a permitted purpose plus adequacy or a safeguard with a documented risk assessment. Brazil requires ANPD's clause text unmodified. Ask your model provider which transfer safeguard it relies on, and confirm with counsel that it satisfies each law you answer to.

Step 9: Prepare a breach response plan for each jurisdiction's deadline

A breach plan is a short runbook saying who does what in the first 72 hours, because most clocks start when you become aware.

Name an incident owner and a backup.
List each regulator and deadline you answer to (see the table below).
Prepare customer notice templates in every language you support, including Arabic and Kurdish.
Document how to revoke and rotate channel tokens, AI API keys and webhook secrets quickly.

Step 10: Review your AI chatbot GDPR compliance checklist on a schedule

Now: confirm you are ready for Egypt's compliance deadline around early November 2026.
Quarterly: review team access, connected channels and active API keys.
Every six months: run a test deletion request and a breach drill.
On every change: update your data map and vendor list when you add a channel, AI model or vendor, and run a privacy risk screening for any new AI use.
Yearly: re-check each country, especially the UAE's Executive Regulations, India's phase from about May 2027 and Iraq's draft law.

Country quick reference: status and breach deadlines (September 2026)

Jurisdiction	Main law	Status (Sept 2026)	Breach notice to regulator
EU/EEA	GDPR + AI Act Art. 50	In force	72 hours (GDPR Art. 33)
United States (federal)	No general privacy law; FTC Act s.5, TCPA, sector rules	No general law; sector rules in force	No general federal duty; sector rules only (HIPAA: individuals within 60 days of discovery, HHS within 60 days for breaches of 500+ individuals and otherwise within 60 days of the calendar year's end; GLBA Safeguards Rule: the FTC within 30 days of discovering an event involving unencrypted customer information of 500 or more consumers)
California (CCPA/CPRA)	Cal. Civ. Code §1798.100 et seq.	In force; CPPA regulations effective 1 Jan 2026	Not set by the CCPA; the separate statute §1798.82 (as amended by SB 446, effective 1 Jan 2026) gives 30 calendar days from discovery to notify affected residents, plus notice to the California AG within 15 days of notifying consumers when more than 500 California residents are affected. Deadlines differ state by state
Saudi Arabia	PDPL (M/19, amended by M/148)	Enforceable since 14 Sept 2024	72 hours to SDAIA (Regulations Art. 24)
UAE (federal)	Decree-Law No. 45 of 2021	In force; Executive Regulations unpublished	"Immediately"; no hour count
DIFC	DIFC Law No. 5 of 2020	In force; amended 2022 and 2025	As soon as practicable (Art. 41); no 72-hour rule
ADGM	Data Protection Regulations 2021	In force and enforced	Without undue delay, where feasible 72 hours
Qatar	Law No. 13 of 2016 (PDPPL)	In force; NCSA guidelines published	None in the statute; NCSA guidance expects 72 hours
Bahrain	Law No. 30 of 2018	In force; PDPA active since 2022	72 hours from discovery to the PDPA
Kuwait	CITRA regulation, amended 2024	Binds CITRA-licensed providers only	24 hours, licensees only
Oman	Royal Decree No. 6/2022	Fully enforceable 5 Feb 2026	72 hours to MTCIT
Jordan	Law No. 24 of 2023	Grace period ended 17 March 2025	72 hours; data subjects within 24 hours
Egypt	Law 151/2020	Compliance period ends around early Nov 2026	72 hours to the PDPC
Morocco	Law No. 09-08	In force; declaration regime	None: Law No. 09-08 sets no general breach-notification duty
Turkey	KVKK (Law No. 6698)	In force, amended June 2024	72 hours to the KVKK Board
India	DPDP Act 2023	Most duties from about May 2027	Detailed report within 72 hours (Rule 7)
Brazil	LGPD	In force, sanctions since Aug 2021	3 business days to the ANPD, doubled for small agents
Iraq	No comprehensive private-sector law	Draft law exists	No statutory duty; confirm with local counsel
Kurdistan Region	No comprehensive law; Law No. 6 of 2008	—	No statutory duty; confirm with local counsel

Iraq and the Kurdistan Region: per DataGuidance, privacy in Iraq rests on the 2005 Constitution rather than a dedicated law. The Kurdistan Region's closest statute is Law No. 6 of 2008 on misuse of telecommunication devices.

How Raabt supports your compliance work in Saudi Arabia, the Gulf and beyond

This is a feature map, not a compliance certification. No tool makes you compliant on its own: your lawful basis, your notices, your retention periods and your contracts decide that. What a platform can do is give you the controls each law expects you to have.

What the law asks for	What Raabt gives you today	What stays your job
Security measures (GDPR Art. 32, Saudi PDPL, Bahrain, Oman, Jordan, KVKK)	Channel access tokens, AI provider keys, webhook secrets and customer phone numbers, emails and order addresses encrypted with AES-256-GCM; passwords hashed with Argon2id; one-time codes stored only as HMAC-SHA256 hashes	Retention periods, device encryption, and the security of anything you export
Access control and least privilege	Four roles (owner, admin, agent, viewer) with per-section permissions, billing restricted to owners, a one-time email code on password sign-in, and session revocation on logout	Reviewing who has access and removing leavers the same day
Telling people they are talking to AI (EU AI Act Art. 50, Maine, Utah)	AI settings are a permissioned section, so only the roles you choose can change how the bot replies	Writing the disclosure line, putting it in the bot's first message, and checking it shows on every channel
Keeping each customer's data separate	Business endpoints confirm the caller is an active member of that business before returning anything	Choosing who you invite into the workspace
Deletion requests (GDPR Art. 17 and equivalents)	Meta's data deletion callback with a confirmation code and a status link on the data deletion page; account deletion needs your password plus an emailed code, then deactivates the account and anonymizes its email	Erasure requests for individual customers, and your own retention and deletion policy
Verified, tamper-checked integrations	Meta webhooks rejected without a valid X-Hub-Signature-256 signature, Telegram webhooks requiring a secret token, and attachments served only through expiring HMAC-signed links	Rotating channel tokens and API keys when staff leave
Breach response (72 hours in the EU, Saudi Arabia, Bahrain, Oman, Jordan and Turkey; 24 hours for Kuwaiti licensees; per-state rules in the US)	Actions by Raabt's own platform staff are written to an append-only log (who, what, when, IP) with secrets redacted	Your incident runbook, regulator notices and customer notices
Sending data abroad	AI provider API keys and service-account JSON are encrypted at the application level (AES-256-GCM)	Choosing which AI provider processes your text, your transfer assessment, standard contracts and any local filing

What Raabt does to protect business data today

No tool makes you compliant; the result depends on how you configure and use it. If you run your AI chatbot on Raabt, these controls are in place today:

Encrypted credentials and selected contact details: channel access tokens (Facebook, Instagram, WhatsApp, Telegram), AI provider API keys, webhook secrets and customer phone numbers, emails and order addresses are encrypted at the application level with AES-256-GCM.
Passwords and sign-in codes: passwords are hashed with Argon2id. Email-and-password sign-ins require a one-time code sent by email before a session starts; Google sign-in does not use this code.
Role-based team access: four roles (owner, admin, agent, viewer) with per-section permissions; billing access cannot be delegated to non-owners.
Isolation between businesses: business endpoints confirm the caller is an active member of that business and return "not found" otherwise.
Verified webhooks: Meta webhooks without a valid X-Hub-Signature-256 signature are rejected, and Telegram webhooks require a secret token.
Session revocation: logout revokes sessions through a blocklist checked on every authenticated request.
Meta deletion requests: Raabt supports Meta's data deletion callback, with a status link on the data deletion page.
Account deletion: it takes a password plus an emailed one-time code. The account is immediately deactivated and its email anonymized, but this does not erase conversation or contact data.

One limit to plan around: conversations are not end-to-end encrypted, because Raabt's servers must read messages to generate AI replies. A server that composes the reply has to read the message first.

Plan retention, access and customer notices with that in mind; see our privacy policy.

Frequently Asked Questions

General information, not legal advice.

Is my AI chatbot GDPR compliant?

Only a review of your own setup can answer that. Check for a lawful basis per purpose, a clear privacy notice, a DPA with every processor, appropriate security such as encryption, and working erasure requests.

Do I have to tell customers they are talking to an AI chatbot?

In the EU, generally yes. Since 2 August 2026, AI Act Article 50(1) has required AI systems that interact with people to make that clear from the first interaction, unless it is obvious. In the US, Maine requires notice where a commercial chatbot could mislead a consumer into thinking they are talking to a human; Utah requires disclosure when the consumer asks, and proactively in high-risk interactions such as those collecting health or financial data.

Does the EU AI Act apply to customer service chatbots?

Yes, through the Article 50 transparency duties for AI systems that interact with people. The Digital Omnibus moved stand-alone high-risk (Annex III) deadlines to 2 December 2027 and Annex I deadlines to 2 August 2028. Check with counsel whether your use case is high-risk.

Do US privacy laws apply to my WhatsApp or Instagram chatbot?

Often, yes — state by state rather than through one federal law. Chat transcripts tied to a phone number or an Instagram handle are personal information under those laws, and bot-disclosure duties plus TCPA consent for outbound marketing sit on top. See the US section above for thresholds and the open TCPA question.

Do I need a DPA with my chatbot provider?

Under GDPR, yes, if the provider processes personal data on your behalf, because Article 28(3) requires a binding contract with each processor. Check sub-processors, AI training terms and deletion at contract end.

How long can chatbot conversations be stored under GDPR?

There is no single number to copy. A common approach is to keep conversations only as long as your stated purpose needs, tell customers that period in your privacy notice, and delete or anonymize the data afterwards. Confirm the period with counsel.

Does Iraq have a data protection law?

Not a comprehensive one for the private sector, though a draft law exists. Article 17 of the 2005 Constitution protects personal privacy and Article 40 protects communications. The Kurdistan Region has no comprehensive law either, so GDPR-level practice is a sensible baseline for now.

Ready to run AI auto-replies with encrypted channel credentials and role-based team access? Start free.

AI Chatbot GDPR Compliance Checklist (2026): PDPL, LGPD & More