What the GDPR says about where a chatbot runs
The GDPR has no rule that personal data must stay in the EU (strictly, the European Economic Area). What it has is Chapter V, Articles 44 to 49: data may go to a country outside it only if the conditions of that chapter are met, by the controller and by the processor, and that includes onward transfers from one provider to the next (Article 44). For a chatbot, a transfer happens wherever a visitor's message, a stored conversation or a lead's e-mail address is sent to, stored in or opened from a third country.
Chapter V offers three routes.
| Route | Where in the GDPR | What it means for a chatbot vendor |
|---|---|---|
| Adequacy decision | Article 45 | The Commission has decided that a country protects data adequately, so transfers there need no further authorisation. For the United States this is the EU-US Data Privacy Framework (DPF) of 10 July 2023, and it covers only companies on the DPF List kept by the US Department of Commerce. |
| Appropriate safeguards | Articles 46 and 47 | Among them, the Commission's standard contractual clauses (SCCs) of 4 June 2021. They come in four modules: Module Two for a controller sending data to a processor, Module Three for a processor passing it on to a sub-processor. Binding corporate rules are the variant for transfers within a group. |
| Derogations | Article 49 | Exceptions such as the visitor's explicit consent after being told the risks. The EDPB says they must stay restricted to specific situations and cannot become the rule, which is a poor fit for a chatbot that sends every conversation abroad. |
Standard contractual clauses are a contract, and a contract cannot bind a foreign government. That is why the Court of Justice held in Schrems II (C-311/18, 16 July 2020) that whoever relies on them must check, case by case, whether the law of the destination country lets the recipient keep its promises, add supplementary measures where it does not, and suspend or end the transfer when nothing helps (paragraphs 133 to 135). Clause 14 of the clauses turns this into paperwork: both parties assess the destination's laws and practices, document that assessment and hand it to a supervisory authority on request. This is what people call a transfer impact assessment. The EDPB's Recommendations 01/2020 describe the work in six steps, from mapping every transfer to re-evaluating at intervals.
Who handles the data for you is a separate question, answered by Article 28. You may use only processors that give sufficient guarantees. A processor may not bring in another one without your prior written authorisation, and under a general authorisation it must tell you of changes so that you can object. The contract keeps the processor to your documented instructions, including on transfers, and every sub-processor takes on the same obligations, with your processor fully liable for it (28(1) to 28(4)).
Note. Where the DPF stands on 25 October 2026. The General Court dismissed an action to annul it on 3 September 2025 (Latombe v Commission, T-553/23), holding that the United States ensured an adequate level of protection on the day the decision was adopted. Mr Latombe appealed to the Court of Justice on 31 October 2025 (C-703/25 P), and the Court's register lists the case as in progress. The two frameworks before the DPF, Safe Harbour and Privacy Shield, were struck down by that Court in 2015 and 2020. In its first review, in October 2024, the Commission found that the US authorities had put in place the structures and procedures the framework needs to function effectively, and planned the next review after three years.
Why buyers still ask for EU hosting
On the law, the vendors who say EU hosting is not required are right. SiteGPT, which processes in the United States, opens its GDPR page with "GDPR does not require EU hosting" (read on 25 October 2026). Chatbase's guide, from a vendor whose main processing is also in the United States, makes the same point and tells buyers to check where the data is kept, which other services get it and from where staff can reach it (read on 25 October 2026). That is a good list, and the checklist below starts from it.
Those who still want processing in the EU have reasons that are practical rather than legal:
- Fewer transfers to document. Every transfer goes into your record of processing, with the country named (Article 30(1)(e)), and into your privacy notice, with the adequacy decision or safeguards it rests on (Article 13(1)(f)). A transfer on SCCs also needs its Clause 14 assessment. A step that runs in the EU needs none of this. SiteGPT's page says so too: EU hosting simplifies matters because it removes the transfer analysis.
- Less exposure when a mechanism falls. Two EU-US frameworks have been struck down, and the ruling that upheld the third is under appeal. After Privacy Shield fell, transfers to the US had to rest on tools such as SCCs, checked case by case, and that check can fail. In May 2023 Ireland's Data Protection Commission fined Meta Ireland €1.2 billion because its transfers to the US, made on the 2021 SCCs with supplementary measures, did not address the risks the Court had identified. That was before the DPF existed.
- An AI model has to read the text. A model can only answer by reading the question, the passages and the conversation in plain text. For a processor that needs data in the clear, in a country whose authorities' access powers go beyond what is necessary and proportionate, the EDPB says it cannot envisage an effective technical measure, and that encryption does not count while the recipient holds the keys (Recommendations 01/2020, paragraphs 94 and 95). Today a transfer to a company on the DPF List needs no supplementary measures at all. If that changed, the steps where a model reads your visitors' words are the ones encryption could not rescue.
- Someone else may require it. If a client contract or a tender asks for processing in the EU, the flexibility of the GDPR does not help you.
If you are wiring a model's API into your site yourself, every one of these points lands on you rather than on a vendor: ChatGPT on your website under the GDPR is written for that case.
What "hosted in the EU" can mean, layer by layer
A website chatbot is a chain of services, and "EU-hosted" can truthfully describe the first link while others run elsewhere. Ask about each one.
| Layer | What passes through it | What to ask | What can go wrong |
|---|---|---|---|
| Application | Every request from the widget and the dashboard | Which provider, and which region? | The application is in the EU and the label stops there |
| Database | Conversations, sources, contact details | Where are the database and its replicas? | A replica or a cache in another region |
| File storage | Documents you upload, files visitors send | Which region, and is storage pinned to it? | A bucket set to a global location |
| Answer model | The question, the passages found, the recent conversation, your instructions | Which provider and region, what it keeps, whether it trains on it; for a gateway, which providers it may pass requests to | The application is in the EU and every question goes to a model API in another country |
| Search vectors (embeddings) | Every passage of your sources when added, every question when asked | Who turns text into vectors, and where? | A second AI provider that is easy to leave off the list |
| Search index | Your content, as vectors and text | Where is the index hosted? | A separate vector database outside the EU |
| Lead alerts, reports, transcripts, ticket replies | Which mail service, and what goes into the mails? | Contact details and whole conversations sent through a mail service abroad | |
| Logs and analytics | Errors, usage, sometimes message text | Which tools, and do logs hold message text? | An error tracker outside the EU that receives a visitor's message |
| Support access | Whatever staff can open | From which countries do staff and contractors work? | The EDPB counts remote access from a third country as a transfer |
| Backups | Copies of the database and files | Where are they kept, and for how long after a deletion? | Deleted conversations kept in backups for a period nobody states |
The checklist: 14 questions for a chatbot vendor
Send these in writing and keep the answers, with the date. A good answer is specific. A red flag is a reason to ask again, not proof of a breach.
| # | Ask | A good answer | A red flag |
|---|---|---|---|
| 1 | Where does each layer run, by provider and country? | The table above, filled in, including the layers outside the EU | "We are EU-hosted", with no list |
| 2 | Who are your sub-processors, what does each do, and where? | A list with purpose and location, plus notice of changes and a chance to object (Art. 28(2)) | A list only after you sign, or one without locations |
| 3 | Can I read your data processing agreement before I buy? | Yes, and it covers what Art. 28(3) lists, from instructions on transfers to deletion and audits | "Our terms of service cover it" |
| 4 | Which transfer tool covers each layer outside the EU? | Per provider: a DPF listing that is active and covers that data, or SCCs with the module named | "We are GDPR compliant", as the whole answer |
| 5 | Where you rely on SCCs, have you documented the Clause 14 assessment? | Yes, and you may read a summary | "Not needed" |
| 6 | Do you or your model provider train models on my content or my visitors' chats? | No, for both, and it says so in the contract | An opt-out in the settings, or silence about the model provider |
| 7 | How long does the model provider keep what it receives? | A period in writing, or zero retention | "We don't control that" |
| 8 | Can I choose the region, and what still leaves the EU if I do? | The steps that stay outside the EU whatever you choose | A region switch that moves storage only |
| 9 | How do I delete one conversation, and what happens when the contract ends? | Deletion per conversation in the product, deletion or return at the end (Art. 28(3)(g)), a stated backup period | Deletion by support ticket, and no word on backups |
| 10 | How fast will you tell me about a breach? | Without undue delay (Art. 33(2)), with a target in hours, since you may have to notify the authority within 72 hours (Art. 33(1)) | No commitment in writing |
| 11 | What can I audit? | Information and audits, including inspections (Art. 28(3)(h)), or reports that answer them | "No audits" |
| 12 | Which certificates do you hold, and what do they cover? | The certificate, its scope and its date | A certificate offered instead of answers 1 to 11 |
| 13 | Where do support staff and engineers access data from? | Countries named, and access from outside the EU covered by a transfer tool | "A global team", and nothing more |
| 14 | Does the chat tell visitors they are talking to an AI, every time? | Built in, at the latest at the first interaction, not left to your welcome text (AI Act, Art. 50(1) and (5)) | It depends on what you write yourself |
For the agreement itself, read what a chatbot's data processing agreement should contain. For question 14, there is example wording for the AI notice, and our AI Act page explains what Article 50 asks.
Common mistakes when checking a vendor
- Checking the company, not the certification. A DPF listing has to be active (companies re-certify every year), cover the kind of data you send and cover the company you actually deal with. The EDPB tells exporters to check this on the DPF List, which also names the companies that have dropped out.
- Treating encryption as the fix for the AI layer. It protects data on the way and at rest, not while a model reads it (Recommendations 01/2020, paragraph 95).
- Asking visitors to consent to the transfer. Explicit consent under Article 49(1)(a) is a derogation for specific situations, not a basis for every conversation on your site.
- Forgetting support access. An engineer outside the EU who opens your conversations makes a transfer, even if the database never moves (Recommendations 01/2020, paragraph 13).
- Letting a certificate answer for the vendor. An ISO/IEC 27001 certificate covers an information security management system. A SOC 2 report is an accountant's examination of a service organisation's controls. Ask what each one's scope includes. Even a certification under the GDPR itself does not reduce the controller's or the processor's responsibility (Article 42(4)).
- Missing training in the terms. A processor works on your documented instructions (Article 28(3)(a)). One that starts deciding why and how your data is used, for instance to improve its own models with your visitors' chats, is considered a controller for that processing (Article 28(10)).
How ChatterLab answers the checklist
We are a chatbot vendor too, so here are our own answers, taken from our documentation, and for Cortecs from its own. ChatterLab is made by SRI Group BV in Antwerp, Belgium. For your visitors' conversations you are the controller and we are your processor. Whether your own use complies also depends on you: your privacy notice, and what you ask your visitors for.
| What | Who | Where |
|---|---|---|
| The application | Vercel | Frankfurt, Germany |
| The database: agents, sources, conversations | Neon (Postgres) | EU |
| Uploaded files, visitors' files and logos | Cloudflare R2 | EU jurisdiction |
| Writing answers, and the grounding check | Cortecs, a European model gateway | Within Europe by default, according to Cortecs (see below) |
| Turning text into search vectors | OpenAI | United States |
| Report and notification e-mails, ticket mail, invitations | Resend | United States, sent from servers in the EU (Ireland) |
| Sign-in to the dashboard | Clerk | Concerns you and your colleagues, not your visitors |
| Payments | Stripe | Concerns you, not your visitors |
The rest of the checklist, by number:
- Sub-processors (2). The table is the list, and it is public in Data and privacy. How changes to it are announced is not described there.
- Agreement (3). Our data processing agreement is sent on request: write to management@sri-group.eu. There is none to sign inside the product.
- Transfer tools (4). Resend processes mail in the United States under the EU-US Data Privacy Framework and standard contractual clauses. For OpenAI, our documentation says it works under OpenAI's data-processing terms, without naming the transfer tool.
- Training (6). We do not train models on your content or your conversations, and OpenAI does not use this data to train its models. Cortecs says in its own documentation that, by default, data is not used for AI training. Training an agent here changes no model at all: the agent searches your sources and answers from them (how that works).
- Region (8). Every plan stores data in the EU, and Enterprise can run in a dedicated EU region with an SLA. In the standard set-up, two steps run in the United States: the text of your sources and of each question goes to OpenAI to be turned into search vectors, and our e-mail goes through Resend. Answers are written through Cortecs, which says that by default all requests remain within Europe. Its Sovereign Cloud setting, which admits only providers based and regulated within the EU, is one our code switches on for reading visitors' scans, not for answers. Without it, Cortecs says, data might be processed by entities of non-EU companies.
- Deletion (9). You delete a conversation with Delete in Activity, or over the API, and deleting an agent removes its conversations and every uploaded file. Nothing deletes conversations automatically. Like anything we delete, it stays a while longer in the backups our database host keeps for restoring. What happens at the end of the contract is not described in the documentation.
- Certificates (12). We claim none. Security describes the measures instead, and what they cannot promise.
- The AI notice (14). Built into the widget, in the widget's language, on every plan, with no setting that removes it. Answers are marked as AI-generated in the page's code, and the agent never claims to be a person.
- Not in our public documentation (5, 7, 10, 11, 13). Transfer assessments, how long Cortecs and OpenAI keep what they receive, our breach-notification time, audit rights, and where staff access data from. Ask for them in writing with the agreement, together with the transfer tool for OpenAI, and hold us to the answers.
What we do not say is that no data leaves the EU, because it would not be true. We name the two US steps instead, and that helps you as well: your privacy notice has to tell visitors that their data goes to a third country and on what basis (Article 13(1)(f)), and you can only write that sentence if your vendor gives you the facts. A privacy notice for your chatbot covers the wording, and our GDPR page has the short version.
Record your assessment on one page
Accountability means you must be able to show how you decided (Article 5(2)), and Clause 14 of the SCCs wants the assessment in writing. For most website chatbots, one page per vendor is enough. Fill it in from the vendor's written answers, date it, and look at it again when the sub-processor list changes or the Court of Justice rules on the DPF. The template is an example: adapt it to your situation, and have your adviser review it where the stakes are high.
CHATBOT VENDOR: TRANSFER RECORD
Vendor and product:
Our role: controller (or processor, for a client)
Vendor's role: processor
Checked on: ... Next check: ...
Documents read: DPA (version, date), sub-processor list (date), privacy notice (date)
Layer Provider Country Personal data in it Transfer tool
Application
Database
File storage
Answer model
Search vectors
Search index
E-mail
Logs, analytics
Support access
Backups
For each layer outside the EU:
DPF: listed, active, covers this data and this company? yes / no, checked on ...
SCCs: which module? Clause 14 assessment seen? ...
Training on our data, by the vendor or the model provider: no / yes, where stated
Model provider keeps inputs for: ...
Deletion per conversation, at contract end, in backups: ...
Breach notice to us within: ... hours
Questions sent on: ... Answered on: ...
Decision and reason:
Reflected in: record of processing (Art. 30), privacy notice (Art. 13(1)(f))
Questions about EU hosting and chatbots
Is EU hosting enough for GDPR compliance?
No. Where the data sits only settles the transfer question. You still need a lawful basis for the chat, a processor contract under Article 28, a privacy notice that names the chat and its recipients, sensible retention periods, security, and a way to answer access and deletion requests. And "EU-hosted" may describe only the application, while the model, the search vectors or the e-mail run somewhere else.
Is it legal to use a chatbot hosted in the United States?
Yes, if every transfer rests on a Chapter V tool. For a company on the DPF List, with an active certification that covers your data, the Commission's adequacy decision is enough. Otherwise you need standard contractual clauses or binding corporate rules, an assessment of the destination's law for that transfer, and supplementary measures where it shows gaps. Either way you also need a processor contract under Article 28.
What is the EU-US Data Privacy Framework, and can I rely on it?
It is the European Commission's adequacy decision of 10 July 2023 for US companies that self-certify with the US Department of Commerce. The General Court upheld it on 3 September 2025, and an appeal to the Court of Justice (C-703/25 P) was still pending on 25 October 2026. While it is in force, a transfer to a company on the list can rest on it. Two earlier frameworks were struck down, so note which of your vendors depend on it and what you would switch to.
Does it matter where the AI model runs?
Yes. To write an answer, the model reads the visitor's question, the passages found and the recent conversation in plain text, so the country where it runs is a transfer question of its own. Encryption in transit and at rest does not change that, because the provider has to read the text to answer. Ask for the model provider, its region and how long it keeps what it receives, by name, and for a gateway, which providers it may route to.
What is a sub-processor?
A processor that your processor brings in to do part of the work. For a chatbot that is typically the hosting company, the database, the model provider, the embeddings provider and the e-mail service. Under Article 28 your vendor needs your written authorisation for them, must impose the same data protection obligations on them, and stays fully liable to you for what they do.
Can I ask a vendor for its data processing agreement before buying?
Yes, and you should. Article 28 requires a written contract with every processor, and you can only judge transfers, sub-processors and deletion by reading it. A vendor that shows its agreement only after you have paid gives you nothing to assess beforehand. ChatterLab sends its data processing agreement on request: write to management@sri-group.eu.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, read on 25 October 2026.
- Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, European Commission, read on 25 October 2026.
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries, European Commission, read on 25 October 2026.
- Judgment of the Court of Justice in Case C-311/18, Facebook Ireland and Schrems, Court of Justice of the European Union, read on 25 October 2026.
- Press release No 91/20: The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield, Court of Justice of the European Union, read on 25 October 2026.
- Press release No 106/25, Data Protection: the General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States, General Court of the European Union, read on 25 October 2026.
- Appeal brought on 31 October 2025 by Philippe Latombe, Case C-703/25 P, Official Journal of the European Union, read on 25 October 2026.
- CURIA - List of results: C-703/25 P, Latombe v Commission, Court of Justice of the European Union, read on 25 October 2026.
- Report on the first periodic review of the functioning of the adequacy decision on the EU-US Data Privacy Framework, COM(2024) 451, European Commission, read on 25 October 2026.
- EU-US data transfers, European Commission, read on 25 October 2026.
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, version 2.0, European Data Protection Board, read on 25 October 2026.
- Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023, European Data Protection Board, read on 25 October 2026.
- EU-US Data Privacy Framework FAQ for European businesses, European Data Protection Board, read on 25 October 2026.
- Data Protection Commission announces conclusion of inquiry into Meta Ireland, Data Protection Commission (Ireland), read on 25 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, read on 25 October 2026.
- ISO/IEC 27001:2022 - Information security management systems, ISO, read on 25 October 2026.
- System and Organization Controls: SOC Suite of Services, AICPA & CIMA, read on 25 October 2026.
- GDPR Compliant Chatbot: Lawful Basis, DPA, SCCs, SiteGPT, read on 25 October 2026.
- Chatbot GDPR Compliance: What to Check Before Launch, Chatbase, read on 25 October 2026.
- Data Governance & Controls, Cortecs, read on 25 October 2026.
- Sovereign Cloud, Cortecs, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.