AI chat can answer enquiries at 10pm on a Sunday, qualify leads before they reach your sales team and stop staff answering the same delivery question twenty times a day. But for UK businesses, a chatbot is also a new way of collecting personal data, which brings obligations under the UK GDPR, the Data Protection Act 2018 and, for marketing messages, PECR. The good news is that getting this right is mostly about sensible design decisions made up front. This article sets out what matters for a small business.
What an AI chat setup looks like
We build on respond.io, which brings website chat, WhatsApp, email, Facebook Messenger and Instagram into one shared inbox. An AI agent then:
- Answers routine questions from a knowledge base you approve.
- Asks qualifying questions such as quantity, budget range, location and deadline.
- Creates or updates a record in your CRM.
- Routes conversations to the right team member.
- Hands over to a person when it is unsure, when the customer asks, or when the topic needs judgement.
Ethergifts Singapore, one of our client sites, uses this approach for WhatsApp enquiries: the AI handles the first response and captures the enquiry, and the sales team picks up qualified conversations.
UK GDPR: the points that matter for chat
Transparency
People must be told who is collecting their data, why and what happens to it. In practice: tell users clearly that they are chatting with an automated assistant, link to your privacy notice from the chat window, and update the notice to cover chat transcripts and the platforms that process them.
Lawful basis
For responding to an enquiry, the lawful basis is usually legitimate interests or steps taken at the person's request before entering a contract. Record which basis you rely on. Adding someone to marketing lists is a separate matter, covered below.
Data minimisation
The bot should only ask for what is needed to handle the enquiry. If you do not need a phone number to send a quote, do not ask for one. We also avoid prompting users for special category data such as health information, and set the agent to steer away from it.
Processors and international transfers
Your chat platform and AI provider act as processors, so you need data processing terms with them. If data is processed outside the UK, appropriate safeguards such as the UK International Data Transfer Agreement or an addendum to EU standard contractual clauses must be in place. We help you check what each vendor provides.
Automated decisions
UK GDPR contains specific rules on decisions made solely by automated means that have legal or similarly significant effects. The Data (Use and Access) Act 2025 reformed these rules, but safeguards such as the right to human intervention remain. An enquiry bot that answers questions and passes leads to staff is unlikely to be making that kind of decision, but if you plan to let AI approve or refuse credit, accounts or applications, take advice first.
Retention and rights
Decide how long transcripts are kept and set the platform to match. Make sure you can find and export a person's conversations if they make a subject access request.
PECR and follow-up marketing
Answering an enquiry is not marketing, but sending promotional follow-ups by email, SMS or WhatsApp is. Under PECR you generally need consent to send electronic marketing to individuals, unless the "soft opt-in" applies to existing customers. Rules for corporate subscribers are different, but sole traders and some partnerships are treated as individuals. The Data (Use and Access) Act 2025 aligns maximum PECR fines with UK GDPR levels, so this is worth getting right. We build consent capture and opt-out handling into the chat flow. This is general information, not legal advice.
Designing the human handoff
A good handoff protects both customer experience and compliance. We agree rules with you such as:
- Complaints, refunds and data rights requests go straight to a person.
- If the knowledge base does not contain the answer, the AI says so and hands over instead of guessing.
- Large or custom quotes go to sales with a summary of the conversation.
- Out of hours, the AI confirms when someone will reply.
After launch, our team reviews conversations and refines the knowledge base and handoff rules.
What it costs in the UK
Prices are shown in pounds sterling. Platform and messaging fees are paid directly to respond.io and Meta.
- Basic (1 channel, 1 AI agent, knowledge base of up to 50 questions): RM3,550 setup + RM410/month.
- Standard (up to 4 channels, enquiry capture, routing): RM7,800 setup + RM810/month.
- Advanced: from RM15,900 setup.
Monthly fees cover knowledge base updates and conversation reviews, with no lock-in. Combine AI chat with a CRM implementation and setup fees are 10% off, or 15% with three or more services.
How we deliver
Setup typically takes about 2 weeks from when we have your materials and access. Everything happens online by WhatsApp, email or text. It starts with a free diagnosis within 24 hours; a 20% deposit starts the work, 60% is due at launch and 20% after sign-off. Monthly fees are billed at the start of each period. Contracts and invoices for overseas clients are issued by AETHER INT'L ENTERPRISE CO., LIMITED, Hong Kong. A rush option roughly halves the timeline for an extra 20% on setup.
FAQ
Do we need to tell customers they are talking to AI?
Being open about it is part of meeting UK GDPR's transparency requirements and is good practice. We label the assistant clearly and make it easy to reach a person.
Do we need a DPIA?
A data protection impact assessment is required where processing is likely to result in high risk. For a simple enquiry bot it may not be mandatory, but a short documented assessment is sensible. We provide the technical details you need for it.
Can the AI stop answering on sensitive topics?
Yes. We configure topics the agent will not handle and route them straight to staff.
Will it work with our CRM?
Yes. respond.io integrates with HubSpot, Zoho, Salesforce and others.
Next step
If you want AI chat that helps your team without creating compliance headaches, request a free diagnosis. We will reply within 24 hours with a recommended setup. Our full pricing is listed online.