GDPR and AI in your business: a practical checklist for enquiries, quotes and sales emails

BOTrento Team3 October 2026 · Updated 11 October 20269 min read

What personal data actually flows through your sales communication

Before you look at tools, list what really circulates in enquiries, emails and quotes. In most B2B companies it falls into these categories:

• Contact details: name, work email, phone number, job title, email signature.
• Content of the communication: the text of the enquiry, requirements, deadlines, event location, history of agreements.
• Commercial data: prices, discounts, billing details. For sole traders these are also personal data.
• Unexpected data: guest lists at events, family circumstances at estate agents, number plates and vehicle history at garages. This is where people most often send more to AI than they need to.

Company details (name, registration number, registered office) are not personal data on their own. But once an email contains the name of an individual, GDPR applies, even in B2B.

Legal basis: what usually comes into play

Every processing of personal data needs a legal basis. In sales communication, three are most often considered:

Steps towards a contract at the customer's request

When someone sends you an enquiry and you reply with a quote, you process their data for pre-contractual steps they asked for. Drafting the reply with AI is just another way of doing the same activity. It usually does not create a new purpose.

Legitimate interest

Follow-ups on quotes, recording deals in a CRM or internal review of enquiries often rely on legitimate interest. You need to be able to justify it and weigh it against the interests of the person concerned. A short written assessment, which you keep on file, is enough.

Consent

Marketing messages to people who never enquired, or using data for a purpose other than the one it was collected for, usually calls for consent or another separately assessed basis. If you wanted to use AI to profile contacts for campaigns, for example, have that assessed separately.

A simple rule applies: AI should do what your salesperson did before, only faster. The moment it starts doing something new, such as scoring people or enriching contacts, a new question about legal basis opens up.

Controller, processor and AI provider: who is who

Your company is the controller of customer data. Every service that works with that data for you (email, CRM, AI tool, process supplier) is usually a processor. With a processor you need a data processing agreement, or terms that include one.

With AI, check these points in particular:

• Type of access. A personal chat account and business access via API often have different terms. With commercial APIs, providers do not use data to train their models. For consumer versions, read the terms separately. The difference between a self-service chat and a managed process is covered in ChatGPT or Claude for your business, or a managed AI process.
• Where data is stored and where it is processed. These are two different questions. Storage may be in the EU while the model still runs at a provider outside it. You then have to deal with a transfer to a third country and how it is safeguarded.
• Sub-processors. Who else gets access to the data, and how you are told about changes.
• Termination. How you get the data back and when it is deleted.

Record each processor in your records of processing activities, if you keep them, or at least in an internal list of tools.

Minimisation: what to send to AI and what not to

In practice, minimisation is the most effective safeguard. To prepare a reply, the model needs the content of the enquiry, not the whole email chain with every signature.

It helps when your process does not depend on each salesperson copying text in their own way. If you keep enquiries in one record and have a clear flow (see how to handle sales enquiries fast without losing any), you can define which fields go to the model and which do not.

Checklist: GDPR and AI in sales communication, step by step

1. List the data. Which personal data appear in enquiries, emails and quotes, including the unexpected ones.
2. Define the purpose and legal basis for replying to enquiries, follow-ups and record keeping. Briefly document any legitimate interest in writing.
3. Choose the type of AI access. Business access or an API with clear terms, not employees' private accounts.
4. Sign agreements with processors and verify where data is stored, where it is processed and whether it is transferred outside the EU.
5. Set up minimisation. Decide what is sent to the model and what is left out.
6. Introduce human approval. No email or quote goes out without a check by the responsible person.
7. Update your privacy information on your website and in your privacy notice.
8. Write a one-page internal rule: who may use which tools and what does not belong in them.
9. Think about people's rights. Where will you find data if someone asks for access or erasure, including AI outputs?
10. Review the process from time to time. Tools and their terms change.

Template: addition to your privacy information

Adapt the text to your situation and have it reviewed:

When replying to enquiries and preparing quotes, we use artificial intelligence tools that help us draft a reply. We process only the data needed to handle your enquiry. Every draft is reviewed and approved by a member of our staff before it is sent. The providers of these tools act as our processors and do not use the data to train their models. Details of data transfers, retention periods and your rights are set out below, or you can write to us.

If AI communicates with customers directly, without human review, also consider the transparency rules for AI. Where a human approves and sends the draft, the situation is simpler, but it is still good practice to tell people that AI is used.

How BOTrento handles it

BOTrento Chief of Staff is a managed process for enquiries, quotes and other sales steps. Several points from the checklist are built into the process itself:

• Human approval. Nothing is sent without approval. Drafts of emails and quotes are reviewed and sent by your own staff.
• Your own API keys. You choose the model provider yourself with your own key (Anthropic Claude, OpenAI, Google Gemini and others) and pay for AI directly to that provider. Keys are encrypted, only the last four characters are visible, and you can remove them at any time. The steps are described in the help page on your own API keys.
• Where the data is. We store data on servers in Germany (EU). The language model processes only the text needed for the task, via the API of the provider you choose. Commercial API providers do not use data for training. To be honest: your own server in the EU that calls an external AI API is not a closed computation, which is why the model provider belongs on your list of processors.
• One record. The process works on top of your CRM or spreadsheet, so no parallel database appears. How to split roles between a CRM and AI is covered in AI on top of your CRM: drafting replies and quotes with human approval.
• Exit. You receive an export of data and outputs and a description of the processes. The date for removing access and copies is agreed in advance.

It is introduced through a 14-day free trial: the 14 days start with your first successful upload of customer data (import or mailbox connection), and you have 7 days to prepare. That lets you set up and verify minimisation and approval on a small, clear scope. The process demo shows how an enquiry moves through the process, and the terms of the trial are on the free trial page.