Your Chat Widget Collects More Than You Think: A GDPR Spring Clean for UK Live-Chat Teams

There's a moment every ops lead has, usually on a Tuesday, when they open the transcript archive to find an old customer query and instead discover three years of conversations, complete with addresses, order numbers and one person's very detailed description of a skin complaint. That's the moment GDPR stops being a policy document in a shared drive and starts being a Tuesday problem.

To be clear up front: I'm not a lawyer and this isn't legal advice. What follows is the practical version — the stuff you can actually action without booking a six-week consultancy project. If your setup is unusual (healthcare, finance, anything involving children), get proper advice. For everyone else, this should get you to a defensible position.

First, admit what you're actually collecting

Live chat feels informal. It isn't. A transcript routinely captures a name, email address, order reference, delivery address, the contents of a complaint, sometimes a phone number, occasionally a screenshot of a bank statement someone has helpfully pasted in. That's personal data. Some of it, if a customer mentions a medical condition to explain a late delivery or a return, is special category data under Article 9 — which is a much stricter regime than most SMEs realise.

And it isn't only the transcript. It's the pre-chat form, the metadata (IP address, location, device), the tags your agents add, any file attachments, and the recordings if you've bolted voice onto the same platform. Do a quick mental inventory of every field your widget collects and ask, for each one: do we need this to answer the question? If not, switch it off. Fewer fields is the cheapest compliance work you'll ever do.

Pick a lawful basis and write it down

Most SME chat operations sit on one of two bases. If someone is buying or has bought, you're largely in contract territory — you need their address to deliver the thing. For pre-sales enquiries and general support chit-chat, legitimate interests is usually the better fit, and it requires you to have actually done a legitimate interests assessment. That's a two-page document, not a saga: what's the interest, is it necessary, does it override the individual's rights. Keep it with your records.

What you almost certainly can't rely on for a live-chat widget is consent, unless you're doing something genuinely optional like marketing follow-ups. Consent that's buried in a chat greeting isn't consent. And if your widget drops non-essential cookies before anyone has clicked anything, that's a PECR issue sitting alongside the GDPR one — worth checking with whoever owns your cookie banner, because the two systems rarely talk to each other.

Retention: the bit everyone skips

Here's the pattern I see again and again. A platform defaults to keeping everything forever, nobody changes it, and three years later the archive is a liability rather than an asset. Set a schedule and enforce it in the tool, not in a spreadsheet.

A workable starting point for a UK SME:

• Sales conversations — 12 to 24 months, long enough to handle a warranty or repeat-order query.
• Support tickets and complaints — 24 months, or longer if a dispute is live.
• Anything containing payment details — delete immediately, and see below.
• Chit-chat and abandoned conversations — 6 months is generous.
• Agent notes and internal tags — align them to the transcript they belong to, not a separate schedule.

Then actually configure auto-deletion in the platform and diarise a check that it's running. Defaults get reset during migrations. Ask me how I know.

Redaction is a habit, not a feature

Some platforms offer automatic redaction of card numbers and other patterns. Turn it on. But don't trust it alone, because customers type card details into the most unlikely boxes and a regex won't catch a sixteen-digit number split by spaces and a typo.

The stronger control is a one-line rule in your agent handbook: never ask for, or accept, full card details in chat. Send a payment link instead. Same for bank details, passport numbers and anything health-related that isn't strictly necessary. If someone volunteers their medical history to explain a return, thank them, note only what you need, and consider whether that note belongs in the transcript at all. Card data in a chat window can also drag you into PCI DSS scope, which is a conversation nobody wants on a Tuesday.

When someone asks what you've got on them

Subject access requests arrive through chat more often than people expect — usually phrased as "can you send me everything you've got on my account?" You have one month to respond, extendable by two for complex cases, and you can't charge a fee except in narrow circumstances. Chat transcripts are in scope.

The practical fix is knowing where the data lives. That means: the chat platform, your CRM, your helpdesk, order system, and any inbox where a transcript was emailed. Do a retrieval dry run once a year on a fake customer. If it takes more than an afternoon, your archiving needs work. Also remember deletion requests — if someone exercises erasure, the transcript has to go too, not just the CRM record.

The AI question you need to ask your vendor

This is the one that catches SMEs out in 2026. If your widget has an AI assistant or summarisation layer, the vendor's terms will say something about model training. Sometimes it's opt-out. Sometimes it's in the subprocessor list. Sometimes it's buried in a product update email from eight months ago.

Three questions to send your account manager, in writing:

1. Do you train models on our conversation data, and can we opt out contractually?
2. Where is the data processed and stored, and is there a UK IDTA or the UK Addendum to the EU SCCs in place for any US transfer?
3. Which subprocessors touch chat content, and how much notice do we get before that list changes?

If the answers are vague, that's your answer. And dig out the data processing agreement — you should have one, it should be signed, and it should describe the actual service you're using, not the one from the 2023 brochure.

Your one-page chat data policy

Pin this somewhere visible. It should fit on a single side of A4:

Chat data policy — [Company] What we collect: name, email, order reference, conversation content, device/IP metadata. Nothing else without a documented reason. Why: contract (existing orders), legitimate interests (enquiries and support — LIA on file). Never collected in chat: full card numbers, bank details, passwords, passport or driving licence numbers, detailed health information. Retention: sales 18 months, support 24 months, abandoned chats 6 months, payment data deleted on sight. Who sees it: [named roles], plus [platform vendor] as processor under DPA dated [date]. AI: model training [on/off] per contract clause [x]. Requests: SARs and erasure handled by [name] within one month; log kept in [location]. Owner and review date: [name], reviewed every quarter.

The fifteen-minute quarterly audit

Put it in the calendar. It genuinely takes a quarter of an hour.

1. Two minutes — open the retention settings in your platform and confirm auto-deletion is still switched on and matching the policy above.
2. Three minutes — pull five random transcripts. Scan for card numbers, health details, addresses. Note anything that shouldn't be there and feed it back to the team.
3. Two minutes — check the pre-chat form fields haven't quietly grown. Platforms love adding fields in updates.
4. Two minutes — confirm your DPA and subprocessor list are current. Check the vendor's status page or trust centre.
5. Two minutes — review agent access. Anyone left in the seat who moved teams in March?
6. Two minutes — check the SAR and erasure log. Anything outstanding past the deadline?
7. Two minutes — confirm AI training settings haven't been reset by a product update.

Fifteen minutes, four times a year. Less time than you'd spend on hold with the ICO, and considerably less than the alternative.

The uncomfortable truth is that chat is the most human-facing data collection most SMEs run, and it's usually the least governed. Fix the basics, write them down, and check them quarterly. That's not bureaucracy — that's just knowing what's in your filing cabinet.