Loading
People type names, addresses, order numbers and occasionally far more into a chat window. That transcript is personal data and needs the same treatment as any other record you hold.
Retention, access and deletion all apply. A transcript store nobody has thought about is a liability that grows daily.
An assistant with record access must resolve permissions the same way a person does. Otherwise a visitor can ask a question whose answer they are not entitled to.
This is the failure that matters most: it does not look like a breach, it looks like a helpful answer, and it will not be noticed.
Yes. Retention, access and deletion obligations apply to them.
Not if permissions are resolved properly. That failure looks like a helpful answer, which is why it goes unnoticed.
Yes, with sources, long enough to review what was actually said.
Half an hour with your own data usually saves reading three of these. The guides will still be here afterwards.