Here is a list of GDPR requirements for chatbots published by an IT and media law firm. I have included questions with each requirement.

1. The right to be forgotten
Any customer can request that a company delete all data about them. This regulates the so-called “right to be forgotten”, which also exists in the GDPR. If a customer insists on this, responsible parties must remove all user data from the chatbot's database.
Questions:
— Can we search for chats in the dashboard and delete them and all associated information about that user if a user requests it?
— What information would a requesting user need to provide (a string from a specific cookie or something else?) for us to find the correct chats and user information?

2. Data Disclosure
Users may at any time request access to the data that those responsible store about them. Chatbot developers must enable customers to download the data stored about them with just a few clicks.
Question: Do you provide a way for us to enable customers to download the data stored about them with just a few clicks?

3. Right to Rectification
Chatbot users are not only allowed to view their data. In accordance with data protection law, they are also allowed to request deletion or modification. It is best for the developers of chatbots to create an access to the personal data. Here, users can then change personal information such as phone number and e-mail address.
Question: Do you provide a way for chat users to do that?

4. Consent Required
The user must expressly consent to the storage process before transmitting and storing his/her data. Here, you must actively obtain consent via an opt-in process. This data protection notice can be implemented with a cookie consent tool. As part of the consent, you should additionally link to your privacy policy.
Question: Can you provide us the name, function and lifetime of the cookies your tool is creating?

5. Data Processing Agreement
If you use external chatbots as a company, you must ensure that the providers of these chatbots handle your users' data in a legally compliant manner. To do this, you must conclude a contract for commissioned processing in accordance with the GDPR. This allows you to relieve yourself of some of the liability and transfer it to the external company.
Question: Do you provide a DPA that we can sign?

6. Privacy Policy
The privacy policy should be up to date. Write it in a language that is easy to understand and simple. Make the privacy policy easily accessible to the user, so that it can be reached from any sub-page and within one click.
Question: Do you provide information/text that we can add to the privacy policy pages of our websites to comply with the GDPR?

Additional questions:
7. Do you have servers inside the EU? If so, does the data on these servers ever leave the EU, or can somebody outside of the EU access this data (and why