Is an AI receptionist GDPR compliant? UK call recording rules explained

Who is responsible: you or the AI provider?

Under UK GDPR, the business that decides why and how caller data is used is the controller. When you put an AI receptionist on your phone line, that is almost always you. The company running the voice agent is usually a processor: it handles the data on your instructions.

This matters because a provider’s marketing claim that its product is “GDPR compliant” does not make your use of it compliant. The provider can give you secure hosting, a sensible contract and good defaults. You still have to decide what you record, tell callers, set retention periods and answer requests from callers about their data.

Two sets of rules apply to recorded calls

Recording or transcribing calls in the UK touches two separate legal regimes. People often mix them up, which is where most of the myths come from.

An AI receptionist has to pass both tests. In practice the data protection side carries most of the work.

Do callers have to consent to being recorded?

Usually, no. The 2018 business monitoring regulations allow a business to record calls on its own system for set purposes, such as keeping a record of transactions or checking quality, provided it makes all reasonable efforts to inform people that calls may be recorded. Law firm Mishcon de Reya summarises the position as consent not normally being required.

Under UK GDPR, consent is also rarely the best choice for routine call handling, because consent must be freely given and can be withdrawn at any time, which is awkward when the recording is how the booking gets made. Most businesses rely instead on one of these lawful bases:

• Legitimate interests: for example, keeping an accurate record of enquiries and checking the quality of answers. You should record a short legitimate interests assessment.
• Contract: where processing the call is needed to book or provide the service the caller is asking for.
• Legal obligation: in sectors where record keeping is required by law.

The ICO offers an interactive lawful basis tool if you are unsure which fits. Whatever you choose, write it down before you go live.

What to tell callers, and how

The ICO’s right to be informed guidance says privacy information must be concise, clear and in plain language, given at the time you collect the data. On a phone call, a layered approach works well:

1. At the start of the call: a short spoken notice. For example (illustrative wording): “Hi, you’re through to [Business]. I’m a virtual assistant. Calls are recorded and transcribed to help us book appointments and improve our service. You can ask for a member of the team at any time.”
2. On request: the agent should be able to explain briefly how the information is used and offer a person.
3. In full: your privacy notice on your website, covering who you are, purposes, lawful basis, who receives the data (including your AI provider), how long you keep it, callers’ rights and the right to complain to the ICO.

We also recommend saying plainly that the caller is speaking to an AI. Being open about automation is part of the ICO’s transparency expectations for AI, and it avoids callers feeling misled. Our AI voice agents introduce themselves as virtual assistants by default and always offer a human handover.

Do you need a DPIA?

A data protection impact assessment (DPIA) is a structured look at the risks of a new processing activity before it starts. The ICO says a DPIA is required for processing likely to result in high risk, and its AI guidance states that in the vast majority of cases using AI will involve processing of that kind. Innovative technology combined with another risk factor, such as sensitive data or large volumes, is one of its listed triggers.

For most businesses putting an AI receptionist live, doing a DPIA is the sensible default. It does not need to be long. Cover at least:

• What data the agent collects, and what it should not collect
• Where recordings and transcripts are stored, and who can access them
• Which suppliers and sub-processors are involved, and in which countries
• How callers are informed and how they reach a person
• What could go wrong (wrong answers, mis-booked appointments, data leaks) and how you reduce each risk

Treat it as a living document and revisit it when you add features, such as new integrations or outbound calling.

Health and other sensitive information

Clinics, dental practices, care providers, law firms and some trades will regularly hear sensitive details on the phone. Information about someone’s health is special category data, and the ICO explains that you need both an ordinary lawful basis and a separate Article 9 condition to process it. For healthcare providers, the health or social care condition, which carries its own requirements, is often relevant; elsewhere it may be explicit consent or another condition.

Practical steps that reduce risk:

• Collect the minimum. An agent booking an appointment usually needs a name, contact details and appointment type, not a full description of symptoms.
• Route sensitive calls to people. Set clear rules for when the agent should hand over, such as distress, clinical questions or complaints.
• Tighten access and retention for any recordings that may contain health information.

If you run a healthcare business, see our healthcare automation page for how we scope this, and check sector rules with your professional body as well as the ICO.

Retention, transfers and automated decisions

How long to keep recordings

UK GDPR sets no fixed period. The ICO’s storage limitation guidance says you must not keep personal data longer than you need it for your purpose, and should set and document retention periods. A common pattern is to keep full audio for a short period for quality checks, keep the transcript or summary in your CRM for as long as the customer relationship needs it, and delete the rest automatically. Pick periods you can justify, and make sure your provider can actually delete on schedule.

Where the data goes

Many voice AI platforms run on infrastructure outside the UK. Transfers of personal data abroad need a valid mechanism. For US suppliers, the UK-US data bridge only covers organisations certified to the UK Extension of the Data Privacy Framework; otherwise a UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses is normally used. Ask your provider which applies to each sub-processor.

Automated decisions

Answering questions and booking appointments rarely amounts to a decision with legal or similarly significant effects on a caller. If your agent screens, scores or refuses people, though, the automated decision-making rules may apply. The Data (Use and Access) Act 2025 replaced the old Article 22 with new provisions, and the ICO has consulted on updated guidance, so check its current automated decision-making page before relying on older advice.

Checklist before you switch on an AI receptionist

1. Confirm you are the controller and your provider is a processor, and sign a data processing agreement covering the terms the ICO lists (instructions, confidentiality, security, sub-processors, help with rights requests, deletion at the end, audits).
2. Choose and document your lawful basis, plus an Article 9 condition if you will handle health or other special category data.
3. Complete a short DPIA.
4. Add a spoken notice at the start of every call, including that calls are recorded and that the caller is talking to an AI.
5. Update your website privacy notice to name call recording, transcription and your AI provider as a recipient.
6. Set retention periods for audio, transcripts and CRM notes, and turn on automatic deletion.
7. Confirm where data is hosted and which transfer mechanism covers any non-UK sub-processors.
8. Define handover rules for sensitive, complex or distressed callers.
9. Make sure your team can find, export and delete a caller’s data when asked.

Our security and data protection page and AI usage policy set out how we handle these points when we build a voice agent for a client. For a wider comparison of phone cover options, see AI receptionist vs virtual receptionist vs answering service.

Frequently asked questions

Is it legal to record phone calls in the UK without telling the caller?

For businesses, you are expected to make reasonable efforts to tell callers that calls may be recorded, and UK GDPR requires clear privacy information when you collect personal data. In practice that means a short notice at the start of every call plus a fuller privacy notice on your website.

Do I need the caller's consent to record a call with an AI receptionist?

Not usually. Business recording for permitted purposes does not normally need consent under the interception rules, and most businesses rely on legitimate interests or contract under UK GDPR. Consent may be needed for some sensitive data or unusual uses, so document your choice.

Do I have to tell callers they are speaking to an AI?

Being transparent about how you process personal data is a core UK GDPR principle, and the ICO’s AI guidance stresses openness about automated systems. Saying up front that the caller is speaking to a virtual assistant, and offering a person on request, is the safest and most trusted approach.

Can an AI receptionist provider store my call recordings outside the UK?

Yes, if a valid transfer mechanism is in place, such as the UK-US data bridge for certified US organisations, an International Data Transfer Agreement, or the UK Addendum to EU standard contractual clauses. Ask the provider to list its sub-processors and their locations.