AI Receptionist GDPR Guide: Recording, Transcripts and Caller Data in the UK

An AI receptionist collects personal data on every call. It hears names, phone numbers and addresses, and often the reason someone is calling, which can include health details, money worries or a complaint. Most providers also record the call and produce a transcript. All of that falls under UK data protection law.

This guide explains how AI receptionist GDPR obligations, and AI voice agent data protection more broadly, work in practice for UK businesses: whether AI phone answering is legal, what callers need to be told, who is responsible for the data, how long to keep recordings and a checklist to work through before launch. It is general guidance rather than legal advice, so speak to a data protection specialist about your own setup, particularly if you handle sensitive information.

Is AI phone answering legal in the UK?

Yes. There is no general ban on businesses using AI to answer calls, and recording business calls is common and lawful when it is done properly. Two sets of rules apply: those on recording communications and those on handling personal data.

Recording is covered by The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. These allow businesses to record calls on their own systems for legitimate purposes such as keeping records of transactions and checking that standards are met, provided the conditions in the Regulations are followed. One of those conditions is making reasonable efforts to let people know that calls may be recorded.

The data itself is covered by UK GDPR and the Data Protection Act 2018. A recording, a transcript and the summary saved to your CRM are all personal data if they identify a caller. That means you need a lawful basis for processing them, must tell callers what you are doing and must keep the data secure and no longer than necessary. AI doesn't create a separate set of rules, but it does make some obligations harder to get right. That is why Blam's AI Receptionist is built on structured guardrails rather than leaving the agent to improvise.

Telling callers about AI and call recording

Transparency is the point where most AI call answering setups either build trust or lose it. Callers are entitled to know how their information will be used at the time it is collected, as the ICO's guidance on the right to be informed sets out.

What to say in the greeting

The greeting should be short, but it needs to cover the essentials: the business name, that the caller is speaking to an AI assistant, that the call is recorded and where to find more information. For example: "Thanks for calling Smith & Co. You're speaking to our AI assistant. Calls are recorded to help us respond to you; our privacy notice is on our website."

UK law doesn't currently set out a specific script for disclosing AI on inbound calls. Telling people anyway is the honest approach, it fits the transparency principle and most callers are comfortable with it. Hiding the fact tends to backfire once callers work it out.

Where the full privacy information goes

A greeting can't hold everything. Your website privacy notice should explain what the AI receptionist collects, why, your lawful basis, who your providers are, how long recordings and transcripts are kept and how people can exercise their rights. The greeting then points callers to it. If you want a reference for structure, Blam's own privacy notice shows the kind of page callers should be able to find. If callers ask the AI about privacy, it should give a clear, approved answer and offer to pass the question to a person.

Controllers, processors and the contract

Several organisations are usually involved in an AI receptionist: your business, the company that set up the agent, and the platforms providing speech recognition, the language model and telephony. Each has a role under UK GDPR, and those roles decide who is responsible for what.

Your business is normally the controller, because you decide why caller data is collected and what happens to it. Your provider is usually a processor, acting on your instructions, and its own suppliers are sub-processors. The ICO's guide to controllers and processors explains how to work out which role applies and notes that processors have direct legal obligations of their own.

In practice, ask your provider for a written data processing agreement, a list of sub-processors and where data is stored and processed. If any data leaves the UK, ask what safeguards cover the transfer. A provider that can't answer these questions clearly is a risk, however good the demo sounds. Blam's article on choosing the right digital partner covers wider questions worth asking any supplier.

How long to keep recordings and transcripts

Keeping everything forever is the default on many platforms, and it is the wrong one. Under the storage limitation principle in the ICO's guide to the data protection principles, personal data must not be kept in an identifiable form for longer than necessary.

Setting retention periods

Set retention by purpose rather than one blanket rule. Raw recordings might only be needed for a few weeks, for quality checks and resolving disputes. Summaries and CRM notes may need to be kept as long as the customer relationship lasts. Recordings with sensitive content may need shorter periods or extra restrictions. Write the periods down, configure the platform to delete automatically and check that deletion actually happens. Remember that copies may also sit in your CRM; if calls feed a system built through CRM and sales automation, apply matching retention rules there.

Handling access and deletion requests

Callers can ask for a copy of their data, including recordings and transcripts, and in some cases ask for it to be deleted. You normally have one month to respond to a subject access request. Make sure you know how to find a caller's recordings and transcripts across every system the AI writes to, including the CRM, email notifications and the provider's own storage.

A practical AI receptionist GDPR checklist

Most compliance problems with AI receptionists come from gaps between systems rather than from the AI itself. Working through a short checklist before launch closes most of them. The ICO's guidance on AI and data protection is the best detailed reference; the ICO notes it is being reviewed following the Data (Use and Access) Act, so check for updates.

Before going live, confirm that:

1. Your greeting tells callers they are speaking to an AI and that calls are recorded
2. Your privacy notice describes the AI receptionist, your lawful basis and retention periods
3. You have a data processing agreement with your provider and a list of sub-processors
4. You know where recordings, transcripts and summaries are stored, including any overseas processing
5. Retention periods are set and automatic deletion is switched on
6. The AI answers only from approved information and doesn't collect details you don't need
7. Sensitive calls, such as health or safeguarding concerns, are routed to a person
8. You have assessed the risks, and completed a data protection impact assessment where the processing is likely to be high risk
9. Your team knows how to find and export a caller's data for an access request

Item eight deserves attention. The ICO expects a data protection impact assessment where processing is likely to result in a high risk to people, and new technology handling sensitive conversations often meets that bar. Clinics, legal practices and financial services businesses should assume they need one.

Governance doesn't end at launch. Review a sample of calls and transcripts regularly, update the agent's information when your services change and recheck retention settings after any platform update. Blam has written about why governance is what makes AI safe in a marketing context; the same thinking applies to voice.

Making AI call answering compliant from day one

AI receptionist GDPR compliance comes down to a handful of decisions made early: tell callers clearly, agree roles in writing with your providers, keep data only as long as you need it and route sensitive calls to people. Get those right before launch and AI call answering is no harder to run lawfully than a well-managed reception desk.

If you would like help setting up an AI receptionist with these controls built in, talk to the Blam team, or see how the service works on the Voice Tech Support AI Receptionist page.

FAQs

Is call recording GDPR compliant?

It can be. You need a lawful basis for recording, must tell callers that calls are recorded and why, keep recordings secure and delete them when no longer needed. Recording rules under the 2018 Investigatory Powers Regulations also require reasonable efforts to let people know calls may be recorded.

Do I need consent to record calls with an AI receptionist?

Not always. Consent is one lawful basis, but many businesses rely on legitimate interests or the performance of a contract for routine call recording. Whatever basis you choose, you still need to tell callers about the recording. Sensitive information, such as health details, needs additional conditions.

Must callers be told they are speaking to an AI?

UK law doesn't currently prescribe a specific AI disclosure script for inbound calls, but transparency is a core data protection principle and telling callers is good practice. A short line in the greeting is enough, backed by fuller details in your privacy notice.

Who is responsible for caller data handled by an AI receptionist?

Usually your business, as the controller. Your provider and its technology suppliers act as processors and sub-processors with their own obligations, but you remain responsible for how callers' data is used. A written data processing agreement should set out each party's responsibilities.