How to Add AI to a Website and Address GDPR Requirements
Add a website AI assistant with a documented data map, lawful bases, supplier checks, privacy information and a tested process for customer data requests.
To add AI to a website and address EU GDPR requirements, define the customer task, map the personal data, choose appropriate lawful bases, check suppliers and test the complete workflow before launch. The plugin is one part of this process. Neither installing it nor adding a consent banner guarantees compliance.
For an existing WordPress site, the standalone Niwa plugin lets you work in the website you already have. Niwa's setup guidance covers the product starting point. Plan the data handling alongside installation rather than writing a privacy notice after customers have begun using chat.
1. Define a limited first task
Choose something with an observable result: answer questions about published delivery policies, explain a service or direct the visitor to an approved booking route. Specify which information the assistant uses and which tasks require your team.
An AI-built website uses AI during construction. An AI-powered website has an ongoing assistant or other AI workflow. Here, the GDPR assessment concerns that ongoing handling of personal data, including prompts and connected services.
Confirm whether EU GDPR applies to your business and audience. If your business also serves other markets, assess their rules separately. Keep the jurisdiction decision in your project notes.
2. Draw the data journey
List the information entering chat, the saved conversation records and any additional fields used for contact, orders or booking. Follow it through hosting, the selected AI provider and enabled integrations.
Document the purpose and recipient for each transfer. Include exports, support emails, backups and debugging logs. If a provider receives recent conversation context to generate an answer, that transmission belongs in the map even if your WordPress database holds the main transcript.
Use fictional test information to confirm the map. Review actual fields and requests where you have authorised access. Do not fill a knowledge base with private customer records merely because they might help the assistant answer questions.
3. Choose a lawful basis for each purpose
GDPR Articles 5 and 6 require lawful, fair processing tied to defined purposes. Customer support, optional marketing and reuse for development can be different purposes with different assessments.
If relying on contract necessity, identify what is genuinely necessary for the contract or the person's requested pre-contract steps. If relying on legitimate interests, document the interest, necessity and balancing assessment. If relying on consent, give a specific, informed and freely given choice that can be withdrawn.
Special categories, including health data, also need an applicable Article 9 condition. A visitor agreeing to a website's general terms does not establish every basis you might need.
4. Check the suppliers and international transfers
Identify controller and processor roles from what each party actually does. Where a supplier processes personal data on your behalf, check the Article 28 arrangements, instructions, subprocessors, security and assistance with individual rights.
Read the terms for the specific account and connection. Confirm training use, retention, supported controls and what happens to logs or stateful features. Personal subscription terms, commercial workspaces and API terms can differ.
Assess transfers outside the EEA under GDPR Chapter V. An EU hosting location does not answer where the selected AI or messaging service processes the request. Record the relevant transfer mechanism and assessment for your setup.
5. Reduce collection and restrict access
Do not require contact details just to explain a public service. Ask for the details needed at the point the visitor requests a next action. Set clear instructions about unnecessary sensitive information.
Keep customer chat permissions separate from owner permissions to edit WordPress. Review the Niwa safety information and the access arrangements in your own installation. Limit transcript and integration access to the people who need it, secure administrator accounts and manage credentials appropriately.
Consider cookies and local storage separately under the applicable national ePrivacy rules. Some storage can be strictly necessary for a requested service; advertising and optional measurement need their own assessment. Do not assume every component of the chat inherits one exemption.
6. Provide information before collecting data
Write a privacy section that reflects the confirmed map. Include the business identity, purposes, lawful bases, recipients, transfers, retention, applicable rights and contact route. Explain whether particular fields are required and what happens if the visitor does not provide them.
Use a short notice at the chat entry point with a link to the full policy. Identifying the assistant as AI addresses a different transparency question and should also be visible where appropriate.
Keep marketing permission separate from the request for support. A privacy-policy acceptance checkbox is not a substitute for a valid choice about optional promotions.
7. Decide retention and prepare data requests
Set retention by the reason for holding each record. A completed conversation, an accounting record and an ongoing complaint need not share a deadline.
Name the person who handles access, correction and erasure requests. Test how they locate a conversation, check identity proportionately and contact the relevant processors. Include backup and export handling in the procedure. Do not promise deletion in a timeframe your suppliers cannot support.
Assess whether the planned processing requires a DPIA under Article 35. The threshold is likely high risk, rather than the mere presence of AI. The ICO's DPIA guidance offers a useful operational checklist, though UK rules and guidance must be considered separately from EU law.
8. Launch after a complete workflow test
Install and configure the chosen Niwa connection, prepare accurate business content and test the defined customer task. How Niwa works explains the product role, but your acceptance test should verify your own notices, permissions and data journey.
Check a normal enquiry, a request that needs a person, an unnecessary personal detail and a data-rights request. Revisit the assessment when you change the provider, add an integration or expand the purpose of chat.
Niwa Business is USD 150 for a custom WordPress website or migration, hosting, maintenance and business-specific AI adaptation. Existing WordPress owners can use the standalone plugin. Discuss your website workflow with Niwa and bring the task and data map so the technical setup can follow a clear scope.
EU legal references checked on 9 October 2026. Have the deployment-specific legal decisions reviewed by the appropriate person for your business.
