GDPR-Compliant AI Voice Agents: What to Check in 2026

Yes, if you set it up right. The GDPR does not ban AI on the phone, but it asks for a legal basis, clear information for callers, a contract with your vendor and secure processing.

You stay the controller. Your business decides what the agent does with call data. The vendor processes it on your behalf and only on your instructions.

An AI voice agent handles more than a voice. Typical data includes:

Usually Art. 6(1)(b) GDPR: the caller wants an appointment, an answer or an order, and you process their data to deliver it. Every extra purpose needs its own basis.

Recording needs consent (point a). Quality reviews can rest on legitimate interests (point f) if callers’ interests do not override yours. Document that balancing test.

Inform callers under Art. 13 GDPR. On the phone, a layered notice works: share the key facts during the call, such as who you are, why you process data and which rights callers have, then send the full notice by link or email. That is how the transparency guidelines of the Article 29 Working Party, endorsed by the EDPB, describe it.

If callers share health details, for example with a medical practice, the stricter rules for special categories in Art. 9 GDPR apply. Check whether you need a data protection impact assessment under Art. 35 GDPR.

Yes. Your vendor processes call data on your behalf, so Art. 28 GDPR requires a data processing agreement, and you can sign it electronically.

With Famulor, you review and sign the DPA in your workspace under Settings → Legal. The Trust Center is its living annex. It lists every sub-processor with purpose, location and transfer basis.

What the DPA should cover:

At Famulor, in Frankfurt: the database runs in eu-central-1, and recordings and files are stored in the Frankfurt region by default. You choose the region for AI processing per workspace: Global, EU Only or US Only.

With EU Only, the workspace shows and uses only EU providers and models, according to the Trust Center. It also lists where each voice and model runs.

If a vendor sits outside the EU, or access from a third country cannot be ruled out, you need a transfer basis under Art. 44 ff. GDPR. The Trust Center names it per vendor, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Enterprise customers can request a transfer impact assessment.

More commitments from the Trust Center: TLS 1.2 or higher in transit, AES-256 at rest, no base-model training on your audio, transcripts or prompts, and retention windows from 1 to 24 months that you set per data category.

Yes, with consent before the recording starts. Recording rules are national, and in Germany, recording someone’s private spoken words without authorization is a criminal offence (§ 201 StGB).

Asking for consent at the start of the call is the safe default in every market. Famulor builds it into the assistant: a consent announcement plays first, the caller agrees verbally or by keypress, and the result is stored with the call. Recording starts only after consent, and the question comes on every call.

If the announcement does not cover recording, the assistant does not record. Remembering returning callers is a separate purpose with its own consent.

No need for audio? Switch recording off. With PII redaction, Famulor replaces personal data such as email addresses, phone numbers, IBANs and card numbers in the transcript before it is stored.

Yes. Since 2 August 2026, Art. 50 of the EU AI Act requires that people are told they are interacting with an AI system, unless it is obvious from the context.

The notice must be clear and come at the first interaction at the latest. The simplest place is the greeting: “Hi, you’re speaking with the AI assistant of Sunrise Dental. How can I help?”

The AI Act also reaches providers and deployers outside the EU when the output of their AI system is used in the EU (Art. 2). A UK or US business whose agent talks to callers in the EU should plan for the notice too.

Famulor checks this automatically for workspaces with the EU Only AI region after an assistant is saved: greeting, consent text and opening prompt are assessed together. Without an AI disclosure, the assistant stays blocked until the opening is fixed or approved in compliance review.

Breaches of the transparency duties can lead to fines of up to €15 million or 3% of worldwide annual turnover (Art. 99 AI Act).

Only with the right consent. The ePrivacy Directive (Art. 13) allows direct marketing with automated calling systems that work without human intervention only with prior consent, and an AI agent can fall under that rule.

National rules add detail. Germany requires prior express consent for marketing calls to consumers and at least presumed consent for business contacts (§ 7 UWG), and consumer consent must be documented and kept for five years (§ 7a UWG).

Service calls, such as a callback the customer asked for, still need a legal basis under Art. 6 GDPR.

In Famulor, each campaign has calling windows per weekday, a central suppression list blocks opted-out contacts right before every dial, and quiet hours pause proactive outreach per channel.

Professional secrecy comes on top of the GDPR. In Germany, § 203 StGB lets doctors, lawyers and tax advisers share secrets with a service provider only as far as its work requires, and they must make sure the provider is bound to confidentiality.

Famulor provides confidentiality declarations for customers bound by professional secrecy in Germany and Austria, and an addendum for customers based in Switzerland covering the Swiss FADP and Art. 321 of the Swiss Criminal Code. They bind Famulor staff to confidentiality, limit access to what the service needs and commit to notice within 24 hours if there are signs of a breach.