Chatbots are the latest emerging technologies used by organizations to improve customer service and reduce costs. Most companies today have deployed chatbots in various messaging apps, websites and portals to provide the first line of service and self-help to customers.
With the advent of GDPR, companies are required to follow the strict guidelines prescribed by it while dealing with sensitive customer data and these rules apply for the company’s chatbots as well. Unlike a traditional web form, chatbots don’t capture user information in a straightforward manner. However, users still share their data with a bot via conversations. Bottomline – ensuring your chatbot is GDPR compliant is mandatory if your customers are citizens of the European Union. This blog shares five actionable tips to ensure your chatbot is GDPR compliant.
GDPR or General Data Protection Regulation came into existence in May 2018 and aims to give users and customers in the EU better control over their data. It makes organizations handling customer data more accountable, transparent and requires them to take clear consent from the customer regarding the usage of their data and privacy.
The kind of personal data protected by GDPR can be broadly categorized as:
Basic unique identification such as name, contact details, address, unique ID numbers, etc
Race or ethnicity
Health, genetic and biometric data (for unique identification)
Sexual orientation
Religious or political beliefs
There are three parties that are involved in GDPR compliance:
Data subject: whose data is processed by a data controller or processor
Data controller: who determines the purpose of collecting data
Data processor: who processes customer or personal data on behalf of the data controller
Irrespective of their industry or size, all organizations have to abide by the regulation. Failing to do so may attract fines to the extent of €20 million or 4% of annual global revenue (whichever is greater).
Now, let’s go back to how you can ensure your bot is GDPR compliant.
Users provide their personal data to chatbots for various purposes such as signing up for newsletters or email notifications, product launch updates, downloading gated content like eBook, whitepapers, etc.
Companies must inform users on why they’re asking for a specific piece of information and how they plan to use it. Also, you should make sure that the data collected is only being used for the stated purposes. For example, if you’ve told them that the chatbot will use their email IDs to send email newsletters about your company’s thought leadership content, you should use the data only for that purpose and nothing more. Leveraging user information for any purpose other than the stated one can attract a hefty penalty under GDPR.
For sending personalized responses to user queries and delivering an enhanced user experience, your chatbot is required to collect and process a lot of personal data. However, in order to use this data, you need the consent of the user.
Right at the beginning of a conversation, the chatbot must provide a consent form to the user. Ensure that the language used in the form is jargon-free and easy to understand for users. People should easily understand why the data is collected and how it’ll be used.
Transparency with respect to data collected is highly important. Users should have full control of and access to the data they provided to the chatbot.
The chatbot should give them this information anytime and through a simple response to their query. Besides, they should be able to download this data for their reference or delete any details.
Upon a user’s query, the chatbot should also be able to answer if his/her data is being used for purposes which are beyond you’ve communicated to them.
Users should be given an option to see your company’s privacy policy before the chatbot starts collecting data. GDPR advises companies to have a clearly stated privacy policy which should address the following concerns:
What data is the bot collecting and on whose behalf?
What will the data be used for and for how long?
Who will be using this data and why?
How can users withdraw their consent?
Merely having consent isn’t all. Any data security threat or breach may prove to be a direct violation of GDPR and can be detrimental to your business.
That’s why once you have consent from the users or customers, you will need to make sure you have stringent data collection and processing measures in place so that it’s immune to unauthorized access. One great way to go about it is encryption. It will ensure that even if an unauthorized user accesses the data, he/she won’t be able to leverage it completely.
The face of sales, marketing and customer service has transformed with the advent of GDPR and organizations will have to abide by the new rules. The points listed above are only a few key tips which will help you stay GDPR-compliant when your chatbot interacts with and collects data from your customers.
GDPR is a vast subject and if you’re planning to build a GDPR compliant chatbot, taking the help of a trusted consultant can make the process smooth.
Acuvate has helped large and medium-sized companies across industries like insurance, banking, financial services, etc. in building GDPR-compliant chatbots and follow a stringent procedure to ensure the chatbot is compliant at every step of its functioning.
For more information on this topic, feel free to reach out to our GDPR and AI experts for a free consultation.
Abhishek is the AI & Automation Practice Head at Acuvate and brings with him 17+ years of strong expertise across the Microsoft stack. He has consulted with clients globally to provide solutions on technologies such as Cognitive Services, Azure, RPA, SharePoint & Office 365. He has worked with clients across multiple industry domains including Retail & FMCG, Government, BFSI, Manufacturing and Telecom.
Abhishek Shanbhag