Yes, an AI receptionist can be GDPR compliant. The technology itself isn’t what decides it. Compliance comes from how the service is set up: what callers are told, what gets recorded and why, where the data goes, and what your contract with the provider says. This guide covers each one, so you know what to check before you sign.
This is general information, not legal advice. Take advice on your own firm’s position where you need it.
What makes an AI receptionist GDPR compliant?
Four things decide it, and all four are within your control when you choose and configure the service.
- Callers are told what happens to their call. A short notice at the start of the call, backed by your privacy notice.
- You have a lawful basis and a clear purpose for any recording or transcription.
- You know where the data goes, including any transfer outside the UK.
- You have a written contract with the provider that covers the terms UK GDPR requires.
What data does an AI receptionist handle?
Start with what the system actually captures. Depending on how it’s configured, that can include the caller’s name and number, the reason for the call, an audio recording and a written transcript. All of it is personal data, and some of it can be sensitive for a professional firm, such as a client’s tax position or a legal matter.
Decide up front what you need. If a name, number and message is enough, ask the provider whether you can limit capture to that. Collecting less is simpler to explain to callers and simpler to protect.
Do you have to tell callers an AI receptionist is recording the call?
Yes, if calls are recorded or transcribed. The Telecommunications (Lawful Business Practice) Regulations 2000 allow a business to record calls for business purposes, but only if it has made all reasonable efforts to inform people that calls may be intercepted.
UK GDPR adds its own requirement. The ICO says you must give people privacy information, including who you are, why you’re using their data, your lawful basis and how long you’ll keep it.
In practice, that means two things. A short spoken notice at the start of the call, and a fuller explanation in your privacy notice. Telling callers they’re speaking to an AI receptionist is good practice too. It fits the ICO’s guidance to be transparent about how you process personal data in an AI system.
Does call data have to stay in the UK?
No. UK GDPR doesn’t require personal data to stay in the UK. It restricts transfers to separate organisations outside the UK unless safeguards are in place.
The ICO’s test for a restricted transfer is simple. If UK GDPR applies and you’re sending personal data, or making it accessible, to a separate organisation outside the UK, the transfer rules apply. Safeguards must be in place before it happens.
So ask more than where the servers are. Ask where the provider and any subprocessors are based, and what safeguards cover any transfer outside the UK.
What should your contract with the provider include?
Where a provider handles callers’ personal data on your behalf, you’ll usually be the controller and the provider the processor. UK GDPR requires a written contract between you.
The ICO sets out the minimum terms in its guidance on what needs to be included in the contract. They include processing only on your documented instructions, a duty of confidence, appropriate security measures, rules on subprocessors, help with individuals’ rights requests, help with breach notification and impact assessments, deletion or return of data when the contract ends, and the information you need to check the provider is meeting its obligations.
If a provider can’t point you to those terms in writing, treat that as your answer.
What are accountants and other professional firms worried about?
Data security is a live concern in the profession. In a Wolters Kluwer survey of 100 UK accountants published in May 2025, 42% said they were concerned about data security and privacy about AI. That’s a fair concern, and one you can answer with the right checks.
Professional bodies publish their own guidance too. The ICAEW’s guidance on AI and accountants sets out the rules and data protection points to follow. Check your own body’s position and your client engagement terms before you go live.
Seven questions to ask any AI receptionist provider
Put these to any provider in writing before you commit.
- Will you sign a data processing agreement that covers the terms UK GDPR requires?
- Where is call data stored and processed, and which subprocessors can access it?
- Is any data transferred outside the UK, and what safeguards cover it?
- What is recorded or transcribed by default, and can we change that?
- How long is call data kept, and can we set the retention period?
- How do you help us respond to access and deletion requests?
- What happens to our data when the contract ends?
What a well configured setup looks like
A well configured build starts with the call notice, the call flow and a clean handover to a person. The data handling questions above should be answered in writing before go live. That’s the work behind our AI call answering for UK firms, and it’s why configuration matters more than the tool itself.
For practices, the same setup is built around deadline season and practice software. See AI receptionist for accountants.
