GDPR and AI phone systems: what UK businesses need to know

This is a practical guide, not legal advice, but the essentials are simpler than the regulations make them sound. If an AI system answers your phone, it processes callers’ personal data (their number, name, what they ask for, and sometimes a recording). That brings it under UK GDPR and the Data Protection Act 2018. Here is what actually matters.

Who is responsible? Controller vs processor

When you use an AI receptionist for your business, you are the data controller and the provider is your data processor, handling caller data on your instructions. That means you should have a written Data Processing Agreement (DPA) with the provider. A good provider offers one as standard.

Call recording and disclosure

You can record calls for legitimate business reasons, but callers must be told. In practice that means a clear disclosure at the start of the call that it is handled by an automated assistant and, where recording is on, that it may be recorded. Recording should be something you can turn on or off, and recordings kept only as long as you need them.

Where the data lives

For UK and EU callers, look for data hosted in the UK or EU, encrypted in transit and at rest. Where a provider uses sub-processors (telephony, AI, email), those should be covered by appropriate safeguards and listed for you.

Callers’ rights

Callers can ask to access, correct or delete the data you hold about them. Your provider should give you the tools to look up, export and erase a caller’s data by phone number, so you can honour those requests quickly.

A checklist for choosing a provider

• Registered with the ICO and offers a DPA as standard
• UK or EU data hosting, encrypted at rest and in transit
• An automated-assistant and recording disclosure at the start of the call, on by default
• Recording is optional, with a configurable retention period
• Self-service tools to access, export and erase a caller’s data
• Never uses your callers’ data to train generalised AI models

How Ringmere handles it

Ringmere is built for this: ICO-registered, stored in the UK and encrypted, with the automated-assistant and recording disclosure switched on by default and spoken at the start of the call, optional recording with a retention window you set, and built-in tools to export or erase a caller’s data. The sub-processors needed to answer a call are named in our privacy policy, some of which process data outside the UK under UK GDPR transfer safeguards. A customer DPA is available on request. See our privacy policy and trust and safety features for the detail.

Want to see it on your own line? Start a 14-day free trial → (cancel anytime).