How do you build a GDPR-compliant chatbot?

What is GDPR / KVKK 6698?

GDPR (EU 2016) and KVKK 6698 (Turkey 2016) are sister data-protection regulations. Any business processing personal data — including chatbot operators — must comply. Penalties range from local fines to 4% of global revenue under GDPR; KVKK fines are typically TRY 1k–1m+ depending on severity.

The 5 conditions a chatbot must meet

Each condition needs its own mechanism:

• Transparency notice: 'your data will be processed for…' on the first message — who, what, why
• Explicit consent: 'yes I accept' for marketing-purpose data use
• Data security: AES-256 at rest, TLS 1.3 in transit, encrypted backups
• Data residency: EU or Turkey-hosted servers (Enterprise; self-host puts data fully on your own infra)
• Subject rights: access, correction, deletion — fulfilled within 24-72 hours

How should the privacy notice look?

Must appear on the bot's first message or before any personal data is shared. Standard content: • Data controller name + contact • What data is collected (name, phone, email) • Purpose (customer service, booking, marketing) • Sharing (third-party recipients if any) • Retention period • Subject rights + how to invoke them LeadsUp ships GDPR/KVKK notice templates; one-click activate.

How does the right to erasure work?

When a customer says 'delete my data', GDPR allows 24-72 hours. In LeadsUp: 1. Bot says 'request received, our team is processing' and fires transfer_to_agent 2. Operator marks the user record 'pending deletion' in the portal 3. Audit log records the request (compliance evidence) 4. Within 24h, conversation + metadata anonymized or hard-deleted 5. Confirmation email to the customer In self-host, data is on your servers — you control deletion directly.

What about sensitive data (health, finance)?

GDPR Article 9 and KVKK 'special category' data: health, sexual life, race, religion, criminal record, biometrics. These require explicit consent + separate encrypted processing. LeadsUp's health template guards the bot from medical data: it never diagnoses or prescribes. Medical questions → auto-transfer to a doctor.

Cross-border data transfer

GDPR/KVKK have special rules for international data transfer. Processing conversations with a US-based LLM (Anthropic) counts as 'transfer'. Two options: (1) BYOK — you contract Anthropic directly; from GDPR's view, you are the controller. (2) Self-host + on-prem LLM (open-source models like Llama, Enterprise). LeadsUp supports both paths.