If a small firm puts an AI-assisted intake form or assistant on its website, it becomes responsible for a stream of personal data it did not handle before: names, contact details, free-text descriptions of someone's situation and, in some professions, information that is more sensitive than the person realises they are giving. The GDPR does not ban this. It asks you to know what you collect, tell people clearly, keep it only as long as needed, and be able to show how it is protected.

This is a working checklist of ten questions to answer before you switch an AI intake system on, whether you build it, buy it or have someone like us run it. It is general information for firms in Spain and the wider EU, not legal advice. Where a point depends on your facts, the answer belongs with your own data-protection adviser.

1. What does the flow actually collect?

List every field, including the ones nobody planned. Free-text boxes and open conversations capture things you did not ask for: health, family circumstances, criminal history, nationality or religion. Some of that may fall under the special categories in GDPR Article 9, which carry stricter conditions. Write the list down; it also becomes the basis of your record of processing activities (Article 30). Then ask whether you need each item at first contact, or only later when a person is handling the case.

2. What is your lawful basis, and is it the right one for each purpose?

GDPR Article 6 requires a lawful basis for each purpose. Taking steps at a person's request before a contract (replying to an enquiry they sent) and legitimate interests (keeping records, preventing abuse) are commonly discussed for intake, and consent is generally what is discussed for marketing follow-ups. Which basis fits a given purpose in your firm is a decision for your adviser; the point of the checklist is that you can name one for each purpose, rather than a single sentence in a footer that covers everything.

3. Do people see a proper notice before they submit?

Article 13 requires you to give people certain information when you collect their data: who you are, your purposes and legal bases, who receives the data, whether it leaves the EU/EEA, how long you keep it, their rights and their right to complain to the supervisory authority (in Spain, the AEPD). On a form, the practical answer is a short layer on the screen plus a link to the full notice, shown before the person presses submit rather than after. Check that the notice describes the automated parts of your flow in plain words.

4. Is it clear to people that they are dealing with AI?

The AI Act's transparency rules in Article 50 have applied since 2 August 2026, including the duty that systems designed to interact directly with people make clear they are AI unless that is obvious from context. One law-firm summary places that chatbot duty on the provider of the system; whether you also have obligations as the business deploying it depends on your set-up. Ask your vendor in writing how the disclosure is handled, and take your adviser's view on your own position. Whatever the legal split, telling people up front is also simply better practice.

5. Do you have a written processor agreement and a sub-processor list?

If a vendor handles personal data on your behalf, GDPR Article 28 calls for a written contract covering what they may do with it, security, help with people's requests, deletion or return at the end, and the conditions for engaging sub-processors. Ask for the contract, a named list of sub-processors (including the AI model providers), and how much notice you get of changes. Ask where data is processed and, if it goes outside the EU/EEA, which transfer mechanism applies. Do not accept "we are compliant" as an answer in place of the documents.

6. How long is data kept, and what actually deletes it?

The storage-limitation principle (Article 5(1)(e)) means choosing a retention period and acting on it. Decide the period with your adviser, then check the places the data lives: the intake database, your CRM, email, chat or notification tools, logs and backups. Ask whether deletion is automatic, how it is tested and what remains afterwards. A common compromise is to keep only a minimal record of someone who asked not to be contacted again, so you can honour that request; ask your adviser whether that fits your case.

7. Can anything be decided by the system alone?

Article 22 restricts decisions based solely on automated processing that have legal or similarly significant effects on a person. An intake system that scores enquiries and routes them is not automatically in that territory, but an automatic decline or a decision that affects someone's access to your services might be. Decide which outcomes a person must review, and make sure the vendor's configuration lets you enforce that. Keep a note of the decision and the reasoning.

8. How will you handle people's requests?

Articles 15 to 21 give people rights of access, correction, erasure, restriction, portability and objection, and Article 12 sets a general deadline of one month to respond. Trace one imaginary request through your system: where would you search for the person's data (database, CRM, inbox, logs, the vendor)? Who runs the search, who approves the answer, and how do you stop follow-up messages the same day? If you cannot trace it on paper, you will not manage it under time pressure.

9. Who can see the transcripts, and what happens if something goes wrong?

Article 32 requires security measures appropriate to the risk. In practice: named users only, strong authentication, least-privilege access, a log of who looks at what, and encryption in transit. Article 33 requires a personal-data breach to be notified to the supervisory authority without undue delay and where feasible within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people; processors must tell you without undue delay. Ask the vendor how quickly they would tell you, and write down who in your firm would decide what to do.

10. Have you screened for a risk assessment?

Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to people, and supervisory authorities publish lists of processing types for which one is required. Whether your intake needs one depends on what it collects and how it is used, so record a screening decision either way, with your adviser's view. Keep the result with your record of processing activities.

Keep an Evidence Folder

When a client, a regulator or a prospective customer asks how your intake handles personal data, the best answer is a folder you can open. A useful minimum is the list of data collected, the notice text with its date, the processor contract and sub-processor list, the retention rule and a record of a deletion test, your Article 22 decision, the screening note from question 10, and a log of requests you have received and how they were answered. For choosing the system itself, see what to evaluate before you buy an AI chatbot and our buyer's checklist.

The Bottom Line

None of these questions needs a law degree to ask. Most need a written answer from a vendor, a decision from you and a note in a folder. Firms that do this before launch are in a stronger position than firms that try to reconstruct it after a complaint. This checklist is a starting point for your adviser, not a substitute for one.

If you want a second view on whether automating part of your intake makes sense, a short, free assessment on the Altamira site can help. Altamira is a new Malaga-based business (founded in 2026), so this article does not cite client results, and it does not claim that any particular setup is compliant for your firm.