GDPR Chatbot Data Processing Agreement Checklist for Online Shops

Before your chatbot handles a customer’s order question, test the provider’s data processing agreement (DPA) against the data that question will expose. Do not stop at a signed document: check whether its processing description covers your setup and whether you can act on its promises when a customer makes a request or an incident occurs. This is an operational review checklist, not legal advice.

Start with the customer chat data your provider will handle

Imagine a customer writes, “Can you check my parcel? My email is maya@example.com.” The bot uses that address to look up an order, replies with the shipping status and hands the conversation to an agent when the customer asks about a missing item. Map what moves at each step before reading the DPA.

Step	Data to trace	Question to record
Incoming message	Email address, question and conversation identifier	Where does the DPA cover messages and contact details?
Order lookup	Lookup input and any order, payment or delivery details returned	Does the scope cover retrieved shop data, not just typed messages?
Bot reply	Data used to compose the answer and the answer shown to the customer	Which parties process the content to produce the reply?
Human handover	Transcript and order context available to the agent	Who may access it, and for which purpose?
After the chat	Stored transcript, exports, operational logs and backups, where applicable	How long might each persist, and what happens on deletion or termination?

If you are considering askVela, its order and customer context in chat makes the order-data question particularly relevant; do not assume that a DPA referring to “chat messages” also describes every piece of context your shop supplies. Separately, telling customers that they are interacting with AI is a different check: see EU AI Act chatbot disclosure for online stores. A disclosure does not replace a GDPR DPA, or vice versa.

Review the DPA clause by clause

Open the agreement, its processing annex and any security schedule side by side. Use this table as a working record, not a pass/fail score. “Evidence” means a clause or document you can identify and revisit; a general privacy-page link is not enough to settle a specific contractual question.

Clause to find	Test question	Evidence to record	If there is a gap
Instructions and scope	Are order lookup, bot replies and agent handover within the documented purposes and instructions?	Applicable clause and annex describing the activity, data types, people concerned and duration	Quote the missing activity and request an updated description or written explanation.
Use of data	Does any wording permit purposes beyond the service you intend to use?	Relevant purpose and instruction language, with clarification of broad terms	Ask what the wording authorises and whether your instructions can narrow it.
Subprocessors	Who may handle chat content, order data or logs, and how are changes handled?	Current list with roles and locations; authorisation, notice and objection provisions	Request the list and the change process; do not rely on an outdated snapshot.
Transfers and remote access	Can any data be accessed or processed outside the EEA?	Answer covering relevant subprocessors and support access, plus applicable transfer documentation if needed	Ask which data and access paths the location answer covers.
Deletion and return	Can you instruct deletion of a named chat and obtain data before contract end?	Instruction route, confirmation process, treatment of copies and exceptions	Ask how transcripts, exports, logs and backups are handled separately.
Security	What protects data in transit and limits access to chats and order context?	Security measures schedule or specific written measures relevant to your flow	Request the missing measures; do not infer a certification from general assurances.
Audit information	How can you obtain information and exercise the audit provision?	Audit clause and a practical route for requesting compliance information	Ask whom to contact and what documentation is available.
Requests and breaches	How will the provider help with customer rights and notify and assist you after a breach?	Assistance and notification clauses, contact route and explanation of what information can be supplied	Request a workable submission and follow-up process.

Check instructions before enabling order lookup

Read the documented instructions against the exact configuration you plan to launch. “Customer support” may be an appropriate overall purpose, but it does not tell you whether the processing description includes a lookup that returns order information. Mark where the annex identifies the types of data and categories of people involved. If you add another channel later, repeat the check rather than assuming the initial instruction covers it.

If the provider points you to a product page, ask for the clause or annex that covers the activity. A feature description can help you identify a data flow; it does not by itself settle the contract scope.

Trace subprocessors and international transfers

For each party on the subprocessor list, ask what it does with your sample chat. A hosting provider, a service involved in generating replies and a party providing technical support may have different access. Record the role, the data involved and the processing location as stated by the provider. Also find out how you will receive notice of changes and how an objection works under the agreement.

Do not treat EU hosting as an answer to every location question. Ask explicitly: “Does your answer cover chat content, retrieved order details, operational logs, backups and staff support access, as well as the main hosting environment?” If processing or access outside the EEA is possible, request the applicable transfer documentation and identify the affected path in your log. Do not mark the question closed merely because a server location has been supplied.

Test deletion and return against a real request

Now imagine Maya asks your shop to erase her parcel-status conversation. You need to know what the DPA commits the provider to do, not just whether a delete button exists. The detailed shop-side procedure for deleting a chatbot conversation after a customer request is separate; here, check what assistance the agreement promises.

1. Identify the record. Ask which reference your shop should provide to identify the chat. An email address alone might not identify every related record.
2. Define what is covered. Ask separately about the transcript, linked customer context, exports, logs and backups. Record any stated limits or retention exceptions instead of treating “deleted” as universal.
3. Find the instruction route. Identify where your shop submits the request and what confirmation or explanation it can expect.
4. Check termination independently. Locate the return-or-deletion clause and ask how you retrieve needed records before access ends and what happens to remaining copies.

Keep two log entries if necessary: “Contract promises deletion assistance” and “Request route confirmed.” The first does not prove the second.

Review security, audit information and assistance

Test the security schedule against the mapped journey: data moves from the customer to the service, order context enters the reply flow, and an agent may see the transcript. Ask what protects transmission, how provider staff access is restricted and removed, and what incident-handling information is available. Ask separately which agent permissions your own shop must set. For product-specific questions, askVela’s security and GDPR overview describes encrypted transmission and privacy controls; use it to frame questions, not as a substitute for the DPA or its security schedule.

Find the clause requiring information to demonstrate compliance and permitting audits. Ask which documents you can request and how you would invoke the provision. If the answer is simply “appropriate security measures,” quote that wording in your log and ask for measures relevant to transmission, staff access and incidents. Do not fill in unstated controls yourself.

Your process for handling an access request for a chatbot conversation should cover the shop-side response. For a breach, find how the provider notifies you and how you obtain follow-up information about affected data and remedial steps. The provider’s notification does not make the shop’s assessment for it.

Send the questions and make a launch decision

Send one request tied to your actual chat flow. Ask for document references so you can close individual log entries rather than relying on a general assurance from a call.

For each reply, log clause or annex; evidence received; open question; owner; decision. For example: “Order lookup — processing annex supplied — returned order fields still unclear — owner: support lead — decision: hold lookup.” That entry tells the next person exactly what to resolve.

Hold launch if a material activity in your planned chat is outside the documented scope or a necessary contract question about subprocessors, transfers, deletion, security or assistance remains unanswered. Track configuration separately: assign an owner to each available retention or access setting, record the intended choice and test it before the widget receives customer data. If the contract questions are resolved but a required shop-side setting is unfinished, keep the widget off until it is ready. A satisfactory DPA is part of the assessment, not a finding that the whole deployment complies with GDPR.