ChatGPT
Claude
Perplexity
Gemini
GrokFor a UK university or college, an "EU-hosted" admissions chatbot is easier to justify than it looks, and less decisive than it sounds. Moving personal information from the UK to the EEA is covered by UK adequacy regulations, so hosting in the EU does not create a transfer problem. What it does not tell you is who controls the service, which sub-processors sit behind it, and who can reach the data from outside the EEA. This guide covers those questions as of 12 October 2026.
Paid keyword volume and difficulty data were unavailable for this topic, so the angle comes from reading official sources. We name no vendor: a fair comparison needs dated public evidence for every cell, and that is a separate exercise.
Why UK admissions teams ask the question
An admissions chatbot collects names, emails, phone numbers, course interests and, in open text, anything a prospective student chooses to tell it. Those conversations often begin months before a UCAS application, in the run-up to Clearing or on a postgraduate enquiry page.
The Information Commissioner's Office (ICO) is the regulator for UK GDPR. If your recruitment also targets applicants resident in the EU, EU GDPR may apply to that processing in parallel, so many providers describe their EU region as a feature for exactly that reason. Check with your data protection officer which regime covers each audience.
What the ICO says about the EEA and the United States
Transfers from the UK to the EEA need no extra safeguard. The ICO states that "All the countries in the European Economic Area (EEA) have full adequacy" under UK adequacy regulations, and that you need no transfer risk assessment when you rely on them (ICO, is the restricted transfer covered by adequacy regulations). A chatbot hosted in Dublin, Frankfurt or Paris is therefore a straightforward choice for a UK institution.
For the United States, the route is the UK-US data bridge. The ICO is explicit: "You must only make a restricted transfer to a US business that has an active status on the DPF list", and that business must have self-certified to the UK Extension (ICO, how the UK Extension works). A vendor certified only under the EU-US framework is not enough; ask which certification it holds.
On the EU side, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, and personal data can flow freely to participating US companies (European Commission, EU-US data transfers). The framework has been challenged in court and an appeal is, to our knowledge, still pending, so build a reversibility clause into any contract that depends on it.
| Vendor setup | Transfer route for a UK school | What to check |
|---|---|---|
| EU company, EEA hosting, EEA sub-processors | UK adequacy regulations for the EEA | Sub-processor list, support access |
| EU company using a model API outside the EEA | Depends on the destination country | Where prompts and logs are processed |
| US company with an EU data region | Restricted transfer if US staff can access data | Active DPF listing with UK Extension, or other safeguard |
| US company without DPF status | Appropriate safeguards and a risk assessment | Documented transfer risk assessment |
Four kinds of alternative
There is no single European option. There are four architectures, each with a different trade-off, and we give no prices because none can be compared from public sources.
| Type | Strength | Watch-out |
|---|---|---|
| European vendor on European cloud | Legal and technical control within the EEA | Which AI model answers, and from where |
| Non-European vendor with an EU region | Mature product | Remote access, parent company outside the EEA |
| Open-source, self-hosted | Full control of data | Your IT team carries security and upkeep |
| In-house build on an EU cloud | Tailored to your processes | Maintenance and answer quality |
Skolbot is a French vendor of admissions chatbots. Put it through the same checklist as everyone else, starting with its processing agreement and sub-processor list.
The AI layer is a processor too
The language model is a sub-processor, and it is the one most often missing from the list. A chatbot hosted in the EEA that sends each conversation to a model API elsewhere has moved the data, whatever the hosting page says. Ask which model answers, which region runs it, how long prompts are retained and whether conversations train the model.
Open text raises the stakes. Prospective students mention disabilities, visa worries or money problems unprompted, and that information should not flow to a provider you have not vetted. Our article on hosting student prospect data outside the EU covers the scenarios in more detail.
Ten questions for the vendor
- In which countries are conversations, backups and logs stored?
- Which legal entity signs the contract, and where is it established?
- Who can access the data remotely, from which countries and why?
- What is the complete sub-processor list, including the AI model provider?
- Does the vendor hold an active DPF listing, and does it include the UK Extension?
- Are conversations used to train any model?
- What is the default retention period, and how are deletion requests handled?
- How and how fast are personal data breaches reported to you?
- Does the processing agreement cover the processor terms required by UK GDPR?
- What are the exit and data return terms?
Get the answers in writing and attach them to the contract. A verbal assurance will not help in an ICO enquiry.
What EU hosting does not fix
Hosting does not replace a lawful basis, a clear privacy notice or data minimisation. The chatbot should ask only for what the admissions process needs, tell the applicant who is responsible for the data and make it easy to exercise their rights. Our guide to GDPR-compliant chatbot vendors goes through those points.
To place this in the wider market, read the comparison of AI agents for student recruitment and the guide to choosing an AI agent. For the overall picture, see our AI chatbot for student recruitment guide.
