GDPR and customer support automation: a practical guide

A support automation touches personal data at several points, often more than the team realises. Mapping them is the first practical step, because each one is a place where data minimisation, retention and vendor contracts come into play.

• Chat and email transcripts: names, emails, phone numbers, order numbers and anything else customers type.
• Helpdesk ticket fields and attachments that an automation reads or copies to another tool.
• Prompts and responses sent to an AI model, if your bot uses one.
• Execution logs in your automation platform, which can store the data each step received.
• Notifications posted to Slack or other internal tools.

Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The EU Court of Justice has described this list as exhaustive and restrictive, so processing has to fit at least one of them.

Two bases come up most often in support work. The contract basis covers processing necessary to perform a contract with the person, or to take steps they asked for before entering into one. In Case C-621/22, the Court of Justice said legitimate interests needs three cumulative conditions: the controller or a third party pursues a legitimate interest, the processing is necessary for that interest, and the person's interests or fundamental rights don't override it. Public authorities can't rely on legitimate interests for processing in the performance of their tasks.

In practice, list each purpose separately. Answering the customer's question, training staff on past transcripts and building reports are different purposes, and each needs its own basis.

Under Article 28(1), you may only use processors that give sufficient guarantees to put appropriate technical and organisational measures in place. Article 28(3) requires a contract or other legal act that sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects. It must also say that the processor acts only on your documented instructions, including on transfers of personal data to a third country. Under Article 28(4), a processor that brings in a sub-processor must pass the same data protection obligations on by contract, and the original processor stays fully liable to you.

• EDPB Guidelines 07/2020: verifying a processor's guarantees is an ongoing obligation, with audits and inspections where appropriate. Instructions can be set out in an annex to the contract or in other written form, such as email, as long as you keep records. A general list of sub-processors that may be updated from time to time isn't enough. The processor should actively tell you about changes.
• EDPB Opinion 22/2024: the duty to check that processors and sub-processors give sufficient guarantees applies whatever the level of risk, although how deep the checks go can vary. The final decision on, and responsibility for, using a specific sub-processor stays with the controller.

A typical support chain can include a helpdesk, an automation platform, an AI model provider and a chat tool. Write down which vendors process personal data on your behalf, check each one's data processing terms and sub-processor list, and keep them on file.

Where your automation runs decides where its data is stored. Make offers two data center locations, the United States and the European Union. You choose one when you create an organization, it can't be changed later, and it decides where your data is stored and processed. If you self-host n8n, its execution settings control how much execution data is kept. The documented default is a maximum of 10,000 stored executions, and 0 means no limit.

Because Article 28(3) covers instructions on third-country transfers, check in each vendor's terms where data is processed. Set retention in every tool that keeps a copy of the data, not just your helpdesk.

• Pass ticket IDs and the fields a step needs instead of whole customer records.
• Mask emails, phone numbers and payment details before text goes to an AI model. Redacted text can still contain personal data, so treat it with the same care.
• Prune automation execution logs and turn off full payload logging where you don't need it.
• Design a way to find, export or delete one customer's data across the bot, the helpdesk and the logs, so individual requests don't need a manual search.
• Send sensitive or high-impact cases to a human agent instead of letting the bot decide.
• Remember that chatbots also fall under the EU AI Act's separate transparency rules.

TascaLab builds automations on top of Zendesk, Freshdesk, Jira, Slack and internal tools, using APIs, webhooks, Make and n8n. Every project includes basic documentation of what was built, which helps when you map data flows, plus 30 days of post-launch support. You can start with a free 30-minute Health Check call.