Calling a product a “GDPR-compliant AI receptionist” does not make the customer's deployment compliant. The business using the service still needs to understand what personal data is processed, why it is needed, which suppliers receive it, how long it is kept and how people can exercise their rights.
This guide is a practical purchasing checklist for inbound call answering, message-taking and appointment requests. It is not a certification of VoiceFleet or another supplier, and it is not legal advice. Outbound sales calls raise separate ePrivacy and national marketing-law questions and are outside this guide.
Start with the data flow, not the sales claim
Before choosing a supplier, draw the proposed flow from the incoming call to every system that may receive information. A typical assessment might cover the phone service, voice or transcription services, the AI model, the receptionist dashboard, a calendar or practice system, notifications, logs and support tools. The exact flow depends on the product and configuration, so ask the supplier to document it rather than assuming.
For each step, record:
- the data received, such as a phone number, recording, transcript or appointment details;
- the specific purpose for using it;
- the lawful basis selected by the business;
- the controller, processor and any sub-processors involved;
- the storage location and any international transfer mechanism;
- the retention period and deletion process; and
- who can access, correct, export or erase the data.
The Irish Data Protection Commission (DPC) says a business processing personal data must have a lawful basis under Article 6. Its lawful-processing guidance lists consent, contract, legal obligation, vital interests, public task and legitimate interests, subject to their conditions. Consent is therefore not the automatic or only answer; the controller must choose and document the basis that actually fits each purpose.
The AI receptionist data-flow review
Use the diagram as a discussion map, not as a description of any particular supplier. A provider should be able to explain which boxes apply to its service and which do not.
Seven checks to complete before launch
1. Define the controller and processor roles
The business normally decides why customer calls are handled and what should happen with the information. A service provider may process data on the business's instructions, but the exact roles can vary by activity.
Where a controller appoints a processor, the DPC's controller-and-processor guidance says the parties must enter a data-processing contract containing the Article 28 terms. Ask for the agreement before launch. Check that it describes the subject matter, duration, purpose, types of data, categories of people, security obligations, assistance with rights requests and the rules for appointing sub-processors.
A signed contract is evidence of one required control. It does not, by itself, prove that the whole deployment is compliant.
2. Separate answering a call from recording it
An assistant can process personal data even when no audio recording is retained. Treat these as separate questions:
- What information is needed to answer or route the call?
- Is audio recorded, and can recording be disabled?
- Is a transcript created or kept?
- What notice does the caller hear or receive?
- What happens if the caller does not want a recording?
- Are local communications or recording rules also relevant?
Do not copy a generic “consent script” into every deployment. The business should decide the correct lawful basis and notice for each activity, taking legal advice where needed.
3. Give callers a clear notice
The DPC's transparency guidance says people should be told who is processing their data, why, the legal basis, recipients or transfers, retention and their data-protection rights. A short call message can point to a fuller notice, but the information must remain accessible.
Test the notice in the actual call flow. Check that it is understandable before sensitive details are requested and that it matches what the configured systems really do.
4. Minimise sensitive details
Collect only what is needed for the defined task. A restaurant may need a name, contact method, party size and time. A salon may need a service and preferred slot. A dental or medical caller may reveal symptoms or treatment information even when the receptionist did not ask for it.
The DPC identifies data concerning health as special-category data. If the workflow processes it, the business must identify an applicable Article 9 condition as well as an Article 6 lawful basis. “We have legitimate interests” is not, on its own, an Article 9 condition.
Useful test questions include:
- Can the assistant take a neutral callback request instead of collecting clinical detail?
- Can free-text notes be restricted?
- Can staff correct a transcript or appointment record?
- Can sensitive details be excluded from notifications?
5. Verify sub-processors and international transfers
“Hosted in Europe” is useful information, but it is not a complete data-flow answer. Ask where call audio, transcripts, logs, backups and support access are handled, and request the current sub-processor list.
Data does not automatically become unlawful because a supplier is outside the EEA. Equally, a European company name does not prove all processing stays in the EEA. The DPC's international-transfer guidance explains that transfers may rely on an adequacy decision or, where appropriate, safeguards such as Standard Contractual Clauses. The controller must assess the actual transfer rather than rely on a country label.
6. Set retention and rights procedures
Write down retention periods for recordings, transcripts, call logs, appointment details and backups. “Keep everything while the account is active” is not a substitute for deciding what is necessary for each purpose.
The right to erasure is not an unconditional promise that every record will always disappear instantly. The DPC's right-to-erasure guidance describes the grounds on which erasure applies. The business should know how to find the relevant data, assess a request, instruct processors and record the outcome.
Run a test using synthetic data: can staff locate a call, correct a mistake, export the relevant record and follow the documented deletion process without exposing another caller's information?
7. Assess security and high-risk processing
Ask for controls that can be verified for the proposed setup: access restrictions, authentication, encryption, audit logs, incident handling, backup practices and staff access. Avoid accepting certification badges or broad “enterprise-grade” wording as a substitute for the applicable evidence.
The DPC says a Data Protection Impact Assessment is mandatory for new high-risk processing projects. A DPIA can document the information flow, risks, safeguards and residual risk. Whether one is required depends on the actual deployment; healthcare data, systematic monitoring, scale and new technology can all affect the assessment.
Evidence to request from an AI receptionist supplier
| Area | Evidence to request | What it does not prove by itself |
|---|---|---|
| Data roles | Current data-processing agreement and role description | That every use chosen by the customer has a lawful basis |
| Data flow | Architecture or flow showing recordings, transcripts, logs, calendars and notifications | That an unlisted integration never receives data |
| Sub-processors | Dated list, purposes and processing locations | That all international-transfer duties are satisfied |
| Retention | Periods by data type, backup treatment and deletion procedure | That every erasure request must be granted |
| Security | Applicable technical and organisational controls, access model and incident process | A guarantee that a breach cannot happen |
| Caller notice | Actual script or notice used in the configured call flow | That consent is the correct basis for every processing activity |
| Rights handling | Procedure for access, correction, restriction, objection, export and erasure | That the controller can respond without its own process |
A safer proof-of-concept
Test the proposed workflow with synthetic callers and an isolated test calendar or inbox. Do not use patient, customer or payment data for the trial.
- Place a call with a fictional identity and ordinary appointment request.
- Record exactly what data is created at each stage.
- Check which people and suppliers can access it.
- Correct one deliberately misspelled detail.
- Exercise the documented export and deletion process.
- Confirm what remains in logs or backups and for how long.
- Repeat with recording disabled, if that mode is offered.
The result is evidence about that configured test—not a blanket compliance certificate or proof about live customer calls.
What VoiceFleet can responsibly say
VoiceFleet provides inbound phone-answering workflows. The GDPR outcome depends on the customer's purpose, configuration, notices, contracts, connected systems and operating procedures. Buyers should request the current data-processing terms, sub-processor information, processing locations, retention options and security documentation for the exact setup being considered.
We will not label a deployment “fully GDPR compliant” on the strength of a feature list. If you book a VoiceFleet demonstration, ask to walk through the data flow and the seven checks above using synthetic details.
Frequently asked questions
Does EU hosting make an AI receptionist GDPR compliant?
No. Location is one part of the assessment. The business still needs a lawful basis, transparency, purpose limitation, data minimisation, an appropriate processor contract, security, retention and rights procedures. If data is transferred outside the EEA, the applicable transfer mechanism must also be assessed.
Is a DPA enough?
No. A data-processing agreement is an important contractual requirement when a controller appoints a processor, but it does not select the controller's lawful basis or make an unnecessary or misleading use of personal data lawful.
Must every AI receptionist call be recorded?
Not necessarily. Recording, transcription, live call handling and keeping call logs are distinct processing activities. Ask which are necessary and whether recording or transcript retention can be disabled for the intended workflow.
Can a dental practice rely only on legitimate interests?
If the workflow processes health data, the practice needs an applicable Article 9 condition in addition to an Article 6 lawful basis. The correct condition depends on the purpose and circumstances; get appropriate advice rather than relying on a generic vendor answer.
Does the right to erasure mean immediate deletion in every case?
No. The right applies when relevant grounds are met and is subject to the GDPR's rules and exceptions. The controller still needs a documented process to assess the request and communicate it to relevant processors and recipients.
Is this page a legal opinion or a compliance certification?
No. It is a buyer checklist based on DPC guidance retrieved on 30 September 2026. Organisations should assess their own purpose, sector, national law and configuration with appropriate legal or data-protection advice.
Updated 30 September 2026: replaced unverified product and competitor promises with a source-linked buyer checklist; removed an unsourced anecdote and unrelated outbound-calling material.