GDPR Access Request for a Chatbot Conversation: Find and Share Chat Data

A customer asks for the data in their chatbot conversation. Before sending a transcript, check whether the request covers other chats or shop records, establish which conversations belong to the customer, and review what those records reveal about other people. You can do this without a dedicated GDPR export: keep a search log, prepare a readable copy and check the finished file before delivery.

Confirm the request and define which chat records to check

“Please send me everything you have from my chat with your bot” is a request for access to personal data, even without the word “GDPR”. “How does your bot work?” may be a service question instead. If the wording is ambiguous, preserve the original message and ask what the customer wants to access. Do not let a clarification about a named chat silently narrow a request that also covers their other shop data.

List the places where relevant data could sit: chatbot and agent conversations, available chat metadata, guest chats, attachments, internal notes, and chat content copied into email or another support channel. If the customer asks for all their data, give the chat search to whoever is coordinating the shop-wide response, including account and order records. Telling visitors they are speaking to a bot is a separate task; the EU AI Act chatbot disclosure guide addresses that distinction.

An address may be shared or mistyped; an order number may appear in someone else’s message. If a guest chat cannot be matched confidently, mark it unresolved rather than sending it or quietly treating it as unrelated.

Find conversations without relying on one identifier

Start with identifiers supplied by the requester or associated with a verified account: current and previous email addresses, account identifiers and relevant order references. Search each location using the fields it actually supports. A customer may have placed an order through their Shopify or WooCommerce account but opened the chat as a guest with a different address. Ask for another address only when it would help resolve a real gap; do not collect a list of addresses speculatively.

Follow leads across channels. For example, if a guest chat mentions an order reference and an email reply later quotes the same reference, inspect both records. Check dates, the account associated with the order and what the customer said before deciding they form one conversation. The same reference could instead have been quoted by another household member. If you cannot distinguish those possibilities, log the candidate for follow-up.

If your shop uses askVela, its team inbox for agents supports assigned conversations, tags and internal notes. Review relevant records available there, then check any separate systems your shop uses. Do not assume a single inbox view searches every location or generates an access-request copy.

Keep a brief reason for excluded matches, such as “order reference appears in a chat linked to a different verified account”. Do not paste that other customer’s transcript into the case log. Also log searches with no result. A missing record may have been deleted under an applicable retention process; the live-chat transcript retention worksheet helps you examine that separate question. Do not imply that a deleted conversation still exists or can be recovered.

Review each matched conversation and its context

Read matched conversations in sequence before copying text. Check who wrote each message, whether the bot handed over to an agent, and whether a later reply changes how an earlier message should be understood. Inspect available contact details, order context, tags, attachments and internal notes too. Where the interface displays order and customer context beside the conversation, check that context separately: it may contain personal data that is absent from the message text.

1. Mark the requester’s data: Their messages, contact details, order-related details and any available observations or assessments about them.
2. Keep useful context: Include a bot question or agent reply where it explains why the requester gave an address, described a purchase or accepted an action.
3. Mark other people’s data: Identify names, addresses, order details and comments concerning another customer, including in quoted replies.
4. Flag uncertain material: If you cannot tell whose data an attachment contains, or how to handle an internal note, refer the decision to your privacy lead or qualified adviser.

A generic product description is not automatically the requester’s personal data. But if they asked whether a replacement fits the item they bought, the answer may be needed to understand their question. Aim for an intelligible copy of the relevant personal data, not a context-free list of isolated customer messages.

Decide what to mask or refer for review

Suppose Maya asks about her delivery, mentions another customer, Leo, and an agent adds an internal note. This is a worked review example, not a rule that every similar passage must be treated the same way. Assess the actual content and seek privacy advice where another person’s rights or an exception may affect disclosure.

Passage in the record	Proposed treatment	Reason and check
Maya: “Can you check the delivery for my order?”	Include.	It is her message, provided the conversation has been matched to her.
Bot: “Which email address did you use at checkout?”	Include as context.	It explains why Maya supplied an address in her next message.
Maya: “Leo next door says his parcel arrived too. His full name is [name], and his address is [address].”	Review; generally mask Leo’s identifying details in the copy.	It is Maya’s message, but it also identifies Leo. Preserve enough wording to explain her concern.
Agent note: “Maya may have received Leo’s parcel; compare delivery details before replying.”	Review; do not omit just because it is internal.	The observation concerns Maya. Check for information about Leo and refer any uncertain disclosure decision.
Attachment showing Leo’s order summary alongside Maya’s label	Separate for closer review; mask or withhold third-party detail where appropriate.	Inspect the image itself, including cropped edges or extra pages, and decide what Maya needs to understand her own data.

Repeat the review for pasted screenshots, quoted emails and copied order details. Mark a masked passage visibly in the supplied copy rather than joining the surrounding text as if nothing were removed. “Internal note” is a location or label, not an automatic exemption.

Prepare a readable copy and deliver it securely

Arrange included records by conversation, with channel, date and speaker labels. If a chat continued by email, label the change of channel rather than merging messages into an apparent single transcript. Provide enough surrounding replies to make the requester’s data understandable. Use a file format the customer can reasonably open; if you create a copy manually, inspect the exported or saved file rather than trusting its editing view.

askVela provides encrypted transmission and privacy controls, but those controls do not perform the matching, redaction or recipient check for you. Use your shop’s own process to prepare and deliver the access-request material.

Close the request with a clear record

Tell the customer what the copy contains rather than attaching an unexplained file. If a guest conversation remains unresolved, describe the narrow detail that would help you assess the match. Coordinate this wording with the person sending the shop-wide response so the chat portion is not mistaken for the complete answer.

Finish the case log with the identity-check outcome, searches, match decisions, review decisions, final-copy reference and delivery details. Keep it under your shop’s applicable retention policy. If identity is disputed, another person’s data is deeply mixed with the requester’s, or you are unsure about a legal obligation, refer the decision for qualified privacy advice before disclosing the disputed material.