Cybersecurity Policy Report, Organizations Should Prioritize Privacy in Chatbot Use, Belgian Regulator Says, (Jun 1, 2026)
By Tony Foley
After conducting an investigation into a conversational smart phone application using artificial intelligence (AI) and large language models, the Belgian data protection authority (DPA) concluded that new technologies were not excluded from the scope of the European Union’s General Data Protection Regulation (GDPR) and that the rapidly evolving technology required a structured approach to data protection.
Describing its findings in a Friday news release, the DPA noted that chatbots users often communicate via free text, meaning that organizations can’t always predict in advance what personal data will be shared in practice. Because these conversations may contain highly sensitive information, organizations must pay particular attention to principles like data minimization, purpose limitation, retention limitation, and transparency, it said.
The DPA found that organizations developing or operating chatbot applications sometimes focus heavily on product development, user experience, and scalability, leaving formal data protection obligations to be dealt with in a structured manner at a later stage. Specifically, the DPA expressed concerns that chat histories often contain large amounts of personal, highly sensitive data and concluded that organizations therefore should provide concrete justifications for retention periods rather than defining extended retention periods without a clear necessity.
With respect to transparency, the DPA said vague or unclear privacy policies were insufficient, finding that clear information must be provided when conversations are stored, analyzed, shared with external providers, or used for model retraining.
Among the recommendations arising from the DPA’s investigation are the following:
Organizations should develop a comprehensive and documented allocation of roles within complex AI systems; and
Organizations should conduct a data protection impact assessment (DPIA) prior to deployment of a chatbot to develop a comprehensive package of technical measures to limit risks to individuals’ rights and freedoms, like automated filtering of harmful interactions or the application of strict access controls to chat data.
“For organizations using chatbots, the key message is clear: data protection cannot be an afterthought, added on after product launch,” the DPA said. “Data protection requirements must be built into the design phase from the outset, rather than hastily added later. This approach is crucial as a solid foundation for these innovative applications, a foundation essential for maintaining long-term user trust.”
News: InternationalLegislation DataPrivacy AINews