An AI receptionist answers calls and books appointments, which means it processes names, phone numbers and often health or financial details. If you operate in Europe or serve European customers, the GDPR applies, and a compliant setup is not optional.
What the GDPR covers on a phone call
A phone call involves more personal data than most people realise:
- Caller identity. Name and phone number.
- Call content. What the caller says, including sensitive details.
- Call metadata. Time, duration and call outcome.
- Bookings. Names, times and sometimes health or financial information.
Each of these is personal data under the GDPR, and each triggers obligations.
The lawful basis question
Before an AI receptionist processes a call, you need a lawful basis. The most common are:
- Legitimate interest. Answering a call a customer initiated is generally a legitimate interest, provided it is balanced and documented.
- Consent. Required where you collect data beyond what the call needs, or for marketing follow-ups.
- Contract. When the call leads to a booking, processing is necessary to perform that contract.
The correct basis depends on what you do with the data after the call. Document your reasoning, because the regulator may ask.
Call recording and transparency
If calls are recorded, the rules tighten:
- Inform callers. Callers must be told they are being recorded and why.
- Minimise retention. Store recordings only as long as needed, then delete them.
- Limit access. Restrict who can listen, and log that access.
On Revenu, transparency and retention are configurable, so you can align the setup with your obligations rather than inheriting a one-size-fits-all default.
Data storage and transfer
Where and how data is stored matters:
- Location. Data should stay in the EU, or with a vendor offering EU-equivalent safeguards.
- Encryption. Data must be encrypted in transit and at rest.
- Access control. Only authorised people should see call records and bookings.
These are vendor responsibilities, but they become your legal exposure, so verify them in writing.
The data processing agreement
Every AI receptionist vendor should offer a Data Processing Agreement (DPA). This contract defines:
- What data is processed and for what purpose
- How long it is kept
- The security measures in place
- Whether sub-processors are used, and where
If a vendor cannot produce a DPA, treat it as a red flag and look elsewhere.
Questions to ask your vendor
Before you commit, get written answers to these five questions:
- Where is call data stored, and is it encrypted?
- Is there a Data Processing Agreement available?
- Can I configure recording, transparency and retention?
- Who are the sub-processors, and are they EU-based?
- How do you handle data subject access and deletion requests?
A vendor that answers these clearly is one you can build a compliant operation on. One that dodges them is not.
Beyond compliance: trust
GDPR compliance is not just a legal box. It is a signal to your customers that you handle their data carefully. For a dental practice, a law firm or a clinic, that trust is the difference between a booking and a lost lead. Getting it right is both a legal duty and a competitive advantage.
Frequently asked questions
- Do I need consent to use an AI receptionist?
- Not always. Answering a call the customer initiated usually falls under legitimate interest, but you need consent for marketing or data beyond what the call requires.
- Can I record calls with an AI receptionist?
- Yes, if you inform callers, minimise retention and limit access. Check your local rules, as some countries require explicit consent for recording.
- What is a Data Processing Agreement?
- A contract between you and the vendor that defines what data is processed, how it is protected and how long it is kept. It is essential for GDPR compliance.
- Where should call data be stored?
- In the EU, or with safeguards equivalent to EU standards, and always encrypted in transit and at rest.
- How do I handle deletion requests?
- Ask your vendor how they support data subject access and deletion requests, and confirm it in writing before you sign.