AI telephony and the GDPR: what about your customers' privacy?

Which data is involved?

A phone call quickly involves personal data: a name, a phone number or the reason for the call. Under the GDPR you need a legal basis for that, such as the performance of a contract or a legitimate interest, and a clear purpose: helping the caller. Don't record more than you need for that, and know which data your AI receptionist stores and for how long.

Who is responsible?

If you use the AI receptionist for your own customers, you are usually the data controller. The provider is then the processor: it processes the data on your behalf, under a data processing agreement. Make sure that agreement exists and states what happens with the data.

Telling callers they are talking to an AI

Callers must know they are talking to an AI. That is not just good manners, it is mandatory: Article 50 of the EU AI Act requires it, and that obligation has applied since 2 August 2026. The notice belongs at the start of the call.

What about call recordings?

Recordings can be useful for quality and summaries, but they are also personal data. Tell callers the call is being recorded, and don't keep recordings longer than necessary.

Where is the data processed?

For the GDPR it matters where data is processed. Within the EU is simplest. Outside the EU it is only allowed with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Many AI services partly run on servers in the United States, so ask: a serious provider tells you exactly which parties process your data, where that happens and on what basis.

What to check with your provider

In short: a data processing agreement, a list of sub-processors and where they process data, appropriate safeguards for processing outside the EU, clear retention periods, an AI notice at the start of every call and openness toward your customers. You can read how ClientAssist handles your data on our security page.