AI Phone Assistant and GDPR: What requirements businesses must meet

As soon as an AI phone assistant takes calls, it processes personal data – at minimum, phone number and call content. This means the GDPR applies in full. The four points that determine permissibility in practice: Legal basis, transparency, data processing agreement and place of processing.

1. Clarify the legal basis

For handling a matter raised by the caller themselves, the initiation or performance of a contracttaking into account, in addition, the legitimate interest in efficient accessibility. If, on the other hand, the conversation is recorded, stricter requirements apply – recording without consent is generally impermissible.

In practical terms, this means that an assistant that records the request in a structured way, rather than storing the recording, is much easier to operate from a data protection perspective.

2. Transparency toward callers

Callers must be able to recognize that they are speaking with an automated system. This follows both from the GDPR transparency principle and from the labeling requirements for AI systems. A clear notice at the start of the conversation is the simplest approach — and in practice, it is usually not an acceptance issue as long as the system then works reliably.

• Notice at the beginning of the conversation that a digital assistant is responding
• Option to reach a human at any time
• Add privacy notices on the website, including purpose and retention period

3. Data processing agreement

If the assistant is operated via a service provider, a data processing agreement (DPA) pursuant to Art. 28 GDPR is required. It regulates the purpose, scope, technical and organizational measures, as well as any sub-processors. Without a DPA, use is not compliant with the law.

4. Where are the data processed?

The location of processing is the point at which offers differ most clearly. Processing within the EU avoids the additional requirements for transfers to third countries. If a model is operated outside the EU, a valid transfer basis and a case-by-case assessment are required.

A practical rule of thumb: the less data the system stores at all, and the shorter the retention period, the simpler the overall setup. Data minimization is not only a legal obligation here, but also saves effort.

Example: Review sequence before implementation

A typical approach: first define which data the assistant actually needs to perform its task — usually name, callback number, and request. Anything beyond that is omitted. Then the retention period and deletion concept are defined, the AVV is concluded, and the privacy notices are updated. Only then does the system go into test operation.

Which GDPR requirements apply to AI phone assistants? The checklist

• Legal basis defined for each processing activity (e.g. contract initiation, legitimate interest, consent for recording)
• Information obligations fulfilled: announcement at the start, detailed information in the privacy policy
• Data processing agreement with the provider and list of subcontractors
• Place of processing known – ideally Germany or the EU
• Data minimization: only name, callback number, request – what is not needed is not collected
• Retention periodsdefined for minutes and transcripts and technically implemented
• Record of processing activities supplemented
• Data protection impact assessment reviewed, especially for sensitive data such as health information
• Data subject rights (information, deletion) organizationally secured

EU AI Act: What additionally applies

In addition to the GDPR, the EU AI Act imposes obligations on companies that use AI. For phone assistants, two points are relevant: people must be able to recognize that they are interacting with an AI system (transparency obligation), and since February 2025 companies must ensure sufficient AI competenceensure that employees who work with the system are informed. A brief training session on how it works, its limitations, and data protection usually covers this. More: AI labelling requirement.

Special industries

Anyone processing health data — for example in medical practices or care services — needs enhanced protective measures and should carry out a data protection impact assessment. For professionals bound by confidentiality, such as law firms, additional duties of confidentiality apply. Industry examples: medical practice and nursing service.

This is how we solve it at bettersorted

Our AI phone assistant is processed exclusively on servers in Germany, with a data processing agreement pursuant to Art. 28 GDPR. Transcripts are used for documentation and are deleted after defined retention periods; callers are informed at the beginning that a digital assistant is speaking. How the assistant works technically is explained by How does an AI phone assistant work?.

Frequently asked questions about AI phone assistants and the GDPR

Do I have to inform callers that an AI is responding?

Yes. Callers must be able to recognize that they are speaking with an automated system. A brief notice at the start of the conversation is sufficient, along with the option to be transferred to a human.

May the assistant record conversations?

Only with the effective consent of the callers. It is much easier to use an assistant that structures and logs the request instead of storing the recording — then the question does not arise in this form.

Do I need a data processing agreement?

Yes, as soon as a service provider processes the data on your behalf. The DPA under Art. 28 GDPR is a prerequisite for legally compliant operation.

Does processing have to take place in the EU?

It is not mandatory, but it makes things much easier because the additional requirements for transfers to third countries do not apply. We therefore explicitly define the processing location before implementation.

What GDPR requirements apply to AI phone assistants?

A legal basis for processing, transparent information for callers including a notice about the AI, a data processing agreement, knowledge of the processing location, data minimization, defined deletion periods, and the protection of data subjects’ rights.

Do I need a data protection impact assessment?

Not in every case. It is required when the processing is likely to pose a high risk, for example with health data or extensive processing of sensitive information. Your data protection officers can help assess this.

Next step

How the assistant works in operation is shown on the product page AI phone assistant. We address data protection questions as part of the implementation – which is 80% eligible for funding through INQA-Coaching.

As of: September 2026. This article is intended as general guidance and does not replace legal advice in individual cases.