Is an AI Receptionist GDPR-Compliant? A Checklist for UK and EU Businesses

Your callers' names, numbers and what they said are personal data. Under UK GDPR and EU GDPR you are the controller; the AI receptionist provider is your processor. That means you need to be able to answer a few questions before you go live.

The checklist

1. Is there a Data Processing Agreement? Article 28 requires a contract with your processor. Silux Voice publishes one: Data Processing Agreement.
2. Who are the sub-processors? Speech recognition, the language model and voice generation may each be a different company. Ask for the live list — ours is at sub-processors.
3. Are calls recorded, and for how long? With Silux Voice, recordings and transcripts are kept only if you turn recording on, and for the retention period you set (90 days by default).
4. Is data encrypted? Look for encryption in transit and at rest.
5. Do callers know? Tell callers the call may be handled by an automated assistant and recorded, and update your privacy notice.
6. Can you act on rights requests? You need to be able to find, export and delete a caller's data when they ask.
7. Are there limits on what it says? A pre-speech check that blocks invented prices, offers and medical advice protects your callers and your business.

Healthcare and regulated sectors

For US healthcare customers, a HIPAA Business Associate Agreement is available on request (BAA). Silux Voice's SOC 2 Type I is in progress, with Type II targeted for the second half of 2026 — see the security overview.

Bottom line

An AI receptionist can be used lawfully under GDPR, provided you have a processor contract, know the sub-processors, control recording and retention, and tell your callers. Read our privacy policy or ask us anything.