GDPR Compliant AI Coaching Depends on How You Set It Up

Is AI coaching GDPR compliant, and why it depends on you

GDPR governs how you collect and use personal data. The moment a client types a message into your Second Self, you are processing personal data: their name, their question, and sometimes details about their health or relationships. How you handle that data decides whether your AI coaching is compliant, and the tool's marketing has no say in it.

Two definitions are worth fixing in your head. The data controller determines the purposes and means of the processing. That is usually you, the coach. The data processor processes personal data on behalf of the controller. That is your software vendor, including the company behind your Second Self. GDPR holds the controller responsible, so your setup decisions matter more than any vendor's claims.

If you serve EU clients, you are likely in scope wherever you are based. Article 3 extends GDPR to businesses outside the EU that offer goods or services to people in the Union, whether or not payment is required. A coach in Austin with three clients in Berlin is likely to have GDPR obligations to those three. UK coaches fall under UK GDPR, and coaches with only US clients should check state laws such as California's CCPA, which gives consumers more control over the personal information that businesses collect about them. For the rest of this guide, assume you have at least some EU or UK clients. For the wider question of whether AI coaching holds up at all, see is AI coaching real.

Pick a lawful basis for your Second Self

GDPR says you cannot process personal data without a lawful basis. Article 6 requires that at least one of its listed grounds applies. It lists six, and for coaches they sort into four groups.

1. 1

   Consent. The client actively agrees to their data being used for AI coaching. It must be freely given, specific, informed, and unambiguous. They can withdraw it at any time, and it must be as easy to withdraw as to give.

2. 2

   Contract. Processing is necessary to deliver a service the client signed up for. If AI access is part of your paid programme, this applies.

3. 3

   Legitimate interests. You have a genuine business reason that does not override the client's rights. The UK regulator's guidance says you should record your assessment and its outcome, so write it down.

4. 4

   Legal obligation, vital interests, and public task. Rarely relevant to coaching.

For most setups, consent or contract is the cleanest choice. If AI coaching is a named part of what the client buys, contract fits. If it is an optional extra, consent fits. Pick one before you launch and document why. That decision shapes your privacy notice and how you handle withdrawal requests.

Do not rely on both for the same processing. Different purposes can rest on different bases, but if you ask for consent and also rely on contract for the same conversations, a client who withdraws consent will expect the Second Self to stop, and you will have to honour that. Choose the basis that matches how you sell the service.

Keep your Second Self away from legal, medical, and therapeutic advice. Article 9 treats data concerning health as a special category, and processing special categories is prohibited unless a specific exception applies. Clients will still sometimes volunteer health details unprompted, so add a line to your disclosure asking them to keep those out of the chat. A disclosure line does not make the problem go away: health details a client volunteers are still special category data once you hold them, so they should sit inside your retention window and your deletion process like everything else.

Consent, contracts, and disclosing the AI to clients

Whatever lawful basis you choose, your clients need to know they are talking to an AI. The regulation expects data to be processed lawfully, fairly and in a transparent manner, and Article 12 asks for information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Hidden AI also erodes the relationship you built.

Put this in front of clients before they start:

You do not need a document that runs to 12 pages. A short privacy notice and a clear AI disclosure cover most of it. Put the disclosure on the first screen a client sees, which is the first contact point for the widget or share link you send them.

Here is wording you can adapt. Treat it as an example and read it against your own setup before you use it.

You are chatting with an AI version of [your name], trained on [your name]'s courses and published material. It is an AI and not a person, and it does not give legal, medical, or therapy advice. Your messages are stored so it can answer you, and they are deleted six months after your programme ends. To see, correct, or delete your data, email [your address]. You can stop using it at any time.

Sample AI disclosure. Adapt the bracketed parts and the retention window.

The EU AI Act adds a separate duty. Article 50 says providers must ensure that AI systems intended to interact directly with people are designed so those people are informed that they are interacting with an AI system. That obligation falls on the vendor first, so ask how the product discloses it, and keep your own notice anyway.

Building a data processing agreement into your vendor stack

If a third party processes personal data on your behalf, GDPR requires a written Data Processing Agreement (DPA). Article 28 says processing by a processor shall be governed by a contract or other legal act. Your AI coaching tool is a processor, and so is your email platform and your course host. You need a DPA with each.

A DPA sets out what the processor can do with the data, how they secure it, and what happens when you leave. Without one, you have a gap that surfaces the moment a client or regulator asks how data is handled.

Three clauses deserve a close read:

• Documented instructions. The processor handles personal data only on documented instructions from you. That keeps the vendor from using client conversations for its own purposes.

• Subprocessors. The processor may not engage another processor without your prior written authorisation, either specific or general. Ask for the current list and for notice when it changes.

• End of contract. The processor deletes or returns all the personal data to you once the service ends. Check how long that takes and whether you receive confirmation.

Before you sign with any AI coaching vendor, ask three things. Do you offer a DPA, and can I read it first? Where is the data stored, and is EU data residency available? Which subprocessors do you use, and does the DPA cover them? A vendor that cannot answer cannot be used compliantly for EU client data, however good the product is.

Apply that test to Personify too. Our privacy page says transfers are conducted under appropriate safeguards, including Standard Contractual Clauses or equivalent UK-approved transfer mechanisms, and that our AWS Lambda infrastructure is based in the eu-west-2 (London) region. We do not publish a DPA or a subprocessor list on this page, so ask us for both in writing before you rely on a Second Self for EU or UK client data, and judge the answers the way you would judge any vendor's. For a broader rollout plan that folds compliance into launch, see implementing AI coaching.

The five point GDPR checklist for coaches

This is the part you can act on today.

A worked example of setting this up for 40 clients

Here is how the checklist plays out for a hypothetical UK coach with 40 active clients, six of them based in Germany and Ireland. This is an illustration and not a real customer.

The whole setup is an afternoon of work plus a quarterly reminder. The only step that depends on someone else is the DPA, so request it first.

Data retention, deletion, and EU data residency

GDPR does not give you a fixed number of months. It asks you to keep personal data no longer than is necessary for the purposes for which it is processed, so you set the window and justify it. Keep conversation data for the engagement plus a defined buffer, delete or anonymise it after your stated window unless you have a legal reason to keep it, and write the window into your privacy notice.

Clients can ask to access, delete, correct, or receive a portable copy of their data, and GDPR gives you one month to respond. Build the process now, and ask your vendor how it supports deletion on its side.

On residency, if your clients or your policy require EU data storage, raise it in your DPA conversation and get the answer in writing. If the vendor stores or accesses data outside the EU or UK, the DPA should also name the legal mechanism covering the transfer. Article 46 names standard data protection clauses as one safeguard, so ask whether the vendor uses them.

Breaches and the 72 hour clock

Under Article 33, a controller notifies the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach, unless the breach is unlikely to result in a risk to the rights and freedoms of people. The same article says the processor must notify you without undue delay after becoming aware of a breach.

That second sentence is why your DPA matters. If your vendor sits on an incident for a week, your 72 hours may already be running down. Ask what the vendor's notification window is, who you contact, and how they will tell you. Write the answers next to your retention policy so a stressful day does not become a guessing game.

Data protection impact assessments for small practices

Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of natural persons. A coach running a Second Self on their own course material for a modest client list may well fall below that line. The picture changes if clients routinely share health or financial details, if you plan to serve thousands of people, or if you add features that profile clients. In those cases, ask a data protection professional whether an assessment is needed. It is far cheaper to do one before launch than after a complaint.

What Personify gives you, and what stays with you

Two Personify features help with your side of this, and the rest sits with you.

For the full operational view of running a Second Self, the AI for coaches playbook ties it together.

Objections coaches raise, answered