It would be very interesting if a bot and their 'business' approached a prospect.
That said prospect then did a SAR on the BOT.
I am sure that the bot has a valid IPO, GDPR compliant procedures, BitLocker Encryption on their laptop, VPN level security on their lap tops, and a procedure in place to deal with any SAR's to ensure that they are dealt with within the DPA guidelines.
Can you imagine the bemused look upon their face, as they get a real taste of how the world works when handling client data in a REAL company.