A GDPR checklist for AI phone calls, in plain words
The GDPR has no chapter on AI phone calls. It has a handful of principles that apply to any personal data, and a phone call is full of personal data: a name, a number, a reason for calling, sometimes a health complaint or a home address. This checklist turns those principles into questions you can answer before you let a voice agent pick up. It is not legal advice. Take it to your own adviser and let them cross things out or add to it.
Before the first call
Write down what the agent will hear and what it will keep. A booking call at a dental clinic contains a name, a phone number, a preferred time and often a reason for the visit. That last one is health information, which the GDPR treats with extra care. A plumber's after-hours line contains an address and the fact that nobody will be home on Thursday. Neither is a secret, but both are personal, and the rules apply to all of it.
The exercise takes ten minutes and it shapes every other answer. If the agent does not need to know why someone wants a dentist, tell it to take a name and a time and leave the reason for the human. Then settle these five things.
- Know your purpose. For each thing the agent asks, write one line on why you need it. A question with no line gets cut.
- Know your lawful basis. The usual candidates are performing a contract with the caller, a legitimate interest you have weighed against theirs, or consent. Which one fits your case is exactly the question for your adviser.
- Decide on recording separately. The call is one thing; a recording of it is a second copy that outlives the conversation. Off, on, or on after the caller agrees are three different choices. Our post on call recording and consent in Europe goes through them.
- Update your privacy notice. It should say that calls may be answered by an automated agent, what is kept, for how long, and who to write to about it.
- Have a processing agreement with the product you use, and know who its sub-processors are. A voice agent uses a company that listens, a company that thinks and a company that speaks. Each one belongs on that list.
During the call
The agent should say it is an AI in its greeting. That is good manners, and transparency about automated processing is one of the GDPR's principles; the EU's AI Act adds its own expectation that people are told when they are dealing with a machine. We wrote about telling callers they are talking to an AI separately.
Collect the minimum. An agent that has been told "get the caller's full name, date of birth and address" will do so on every call, including the one where a supplier just wants to know if you are open. Write the instructions so it asks for what the task needs and nothing more.
Keep a way to a person. A caller who says "I want to talk to a human" should get one, or a callback, without a fight. This is a data protection matter as well as a service one: people should not be stuck with a machine for decisions that matter to them.
After the call
- Retention is a number of days, and it can differ per thing. A recording may live for a month, a transcript for a season, a summary for as long as the customer record. Decide each one; do not let "forever" be the default.
- Deletion must be something you can do yourself. If a caller asks you to erase their call, you should be able to find it by number and remove it without writing to a supplier.
- Access is a role, not a habit. Decide who can listen to recordings and who only sees summaries, and keep a log of who changed what.
- Export should be possible too. If a caller asks what you hold about them, a transcript and a summary are what you will hand over.
Where the data travels
Hosting inside the EU makes the transfer question simpler, because there is no transfer to explain. It does not make the question disappear: the model providers behind the agent also process the audio and the text, and each one has its own location and terms. Ask your supplier which provider handles which step, and whether you can choose the models yourself. We explained why we think this should be a visible setting in why your AI receptionist should live in the EU.
How to use this list
Print it. Walk through it with the person who owns your privacy notice, and then with your adviser. The most common mistake we see is treating hosting as the whole answer and leaving retention at "forever". The second most common is a consent line in the greeting that nobody has read aloud to check whether it sounds like something a person would say. Fix those two and you are ahead of most phone systems, human or not.
Where NordTell fits
NordTell gives you the settings this list asks about: recording off, on or on after consent per agent, retention in days, roles, an audit log, deletion from the dashboard, and the provider printed next to each model. The servers are in the EU. Whether your set-up is compliant is a judgement for you and your adviser; we make the switches visible so that judgement is easier to make.
Recording and retention settings · Call recording and consent in Europe