AI Voice Agents and UK GDPR: A Compliance Guide

Under UK GDPR, an AI voice agent is a processing activity you are responsible for as controller. You need a lawful basis for recording and transcribing calls, a defined retention period, a written processor agreement with your provider, and a transparency notice the caller can reach before or at the start of the call.

Compliance is not a property of the software. Two businesses can run the same AI voice agent and one be compliant while the other is not, because the obligations attach to how you deploy it: what you record, why, for how long, and what you tell people. This guide walks the decisions in the order you actually have to make them.

It is general guidance, not legal advice. For anything involving special category data — health information above all — take advice specific to your practice.

1. You are the controller

That allocation matters because the accountability sits with you. The ICO's guidance on AI and data protection is the reference point, and it is written on the assumption that the deploying organisation makes the decisions.

2. Pick a lawful basis before you switch anything on

Call audio and transcripts are personal data. Answering the call at all needs a basis; recording it needs the basis to cover recording specifically.

That last row is the one businesses miss. Ask your provider directly, in writing, whether call audio or transcripts are used to train models, and whether that can be disabled at the account level.

3. Tell the caller, at the start

Transparency is where most deployments fall short, and it is also the cheapest thing to get right. Three elements belong at the top of the call, in the assistant's own words rather than a legal recital.

1. 1That they are speaking to an automated assistant. Not disclosing this is a transparency problem before it is anything else, and the direction of UK regulatory thinking is clearly towards disclosure.
2. 2That the call is recorded, and broadly why. One sentence. "This call is recorded so we can add the details to your record."
3. 3Where the full notice lives, and how to reach a person. A named page on your website, and a route out of the automated conversation at any point.

4. Set a retention period and enforce it

"We keep recordings indefinitely" is not a retention policy. Decide the period per category, write it down, and confirm your provider actually deletes on that schedule rather than merely hiding the record.

• Raw audio usually has the shortest justified life — often weeks rather than months, unless a specific dispute or obligation extends it.
• Transcripts and summaries attached to a client record typically follow that record's own retention rules.
• Structured outcomes — the booking, the outcome code — are ordinary business records and retained as such.

5. Get the processor agreement right

Article 28 requires a written contract with specific terms. When assessing a vendor, four questions do most of the work.

1. 1Where is the data processed and stored? If it leaves the UK, ask which transfer mechanism applies and get it in writing.
2. 2Who are the sub-processors? Speech-to-text, model hosting and telephony are frequently three different companies. You need the list and notice of changes.
3. 3How are deletion requests handled? A data subject asking you to erase their data means you must be able to instruct the processor and get confirmation.
4. 4What happens at the end of the contract? Return or deletion, on a defined timescale.

6. Handle data subject rights in practice

Someone can ask for a copy of what you hold, including the recording of their own call. If your setup cannot locate every recording tied to one individual within the statutory month, it is not compliant in practice however good the paperwork is. Test this before you scale up: pick a caller, and try to retrieve everything.

7. Decide whether you need a DPIA

A data protection impact assessment is required where processing is likely to result in high risk — and new technology processing personal data at scale, especially health data, sits squarely in that territory. For a single practice booking routine appointments the assessment may be short, but doing it produces the record of reasoning you will want if anyone ever asks.

A practical checklist

1. 1Map the dataList what is captured on a call: audio, transcript, name, contact details, and anything special category.
2. 2Record the lawful basisOne line per activity, with the balancing test written down where you rely on legitimate interests.
3. 3Write the caller noticeThe spoken disclosure at the start of the call and the full notice on your website.
4. 4Set retentionPer category, with the deletion mechanism confirmed in writing by your provider.
5. 5Sign the processor agreementIncluding sub-processors, transfer mechanism and end-of-contract deletion.
6. 6Test a subject access requestRetrieve everything held about one caller, end to end, and time it.

None of this is exotic; it is the same discipline you already apply to your CRM, extended to the phone. If you want to go through it against your own setup, book a demo call and bring your data protection questions — we would rather answer them before a deployment than after.

← All articles