Call Recording and AI Phone Agents: GDPR Basics
By CodexierPublished 8 min read
An AI receptionist does not just answer the phone. It usually records the audio, transcribes it, and writes a summary into your calendar or CRM. Each of those is personal data about the caller, and Swedish practice under GDPR is clear that a company cannot collect it quietly. This guide walks through what you must decide before go-live: what you actually store, on which legal basis, for how long, and what your vendor has to sign.
Is the call recorded, transcribed or both?
Start by asking your supplier exactly what is stored and where. Many AI phone platforms keep the raw audio by default for quality review, keep the transcript to train prompts, and push a summary into your systems. Each layer adds risk: audio contains the caller's voice (which can be biometric data if used for identification), a transcript can contain health details or a child's name said in passing, and a summary is the one you will actually search later. The Swedish Authority for Privacy Protection, IMY, has repeatedly stressed data minimisation: if you do not need the audio after the booking exists, do not keep it.
Legal basis and informing the caller
Consent is the basis people reach for first, and it is usually the wrong one for a phone line. A caller who wants to book cannot meaningfully refuse recording without losing the service, which undermines the freely given requirement. Most Swedish service businesses instead rely on legitimate interest for handling the errand and on performance of a contract for the booking itself. That works only if you have written down a balancing test: why you need the data, why the caller would reasonably expect it, and what you do to limit the intrusion.
| Data item | Typical legal basis | What the caller must be told |
|---|---|---|
| Booking details (name, phone, time, service) | Contract (the booking) | That the booking is saved and a confirmation is sent |
| AI summary of the call | Legitimate interest | That notes are kept for follow-up and how long |
| Full transcript | Legitimate interest, only with a short retention | That the conversation is transcribed |
| Audio recording | Legitimate interest with a documented reason, or consent | That the call is recorded and why |
| Health or other sensitive details | Avoid collecting; escalate to a human | That sensitive matters are handled by staff |
Sensitive categories such as health data need an Article 9 exception. For a clinic, the safest design is that the AI books and a human takes the medical detail.
Whatever basis you choose, the caller must be informed at the moment of collection. On the phone that means the greeting, backed by a privacy notice on your website that says the same thing in more detail. If your call script is built well, this information takes about eight seconds and nobody hangs up. We cover the script itself in how to write an AI receptionist call script.
Retention and deletion
GDPR does not set a number of days. It says: no longer than necessary for the purpose. So write the purpose first and derive the period from it. A recording kept to resolve a dispute about what was said can reasonably be deleted once the appointment has taken place. A summary kept as part of the customer relationship can follow the customer record. Nothing needs to exist for years because it might be useful.
- Audio: delete automatically within days, or do not store it at all. If you keep it for quality review, set a rolling window and document it.
- Transcript: delete when the booking is confirmed or the errand closed. Keep it out of shared inboxes.
- Summary: retain with the customer record, and include it in your deletion routine when a customer asks to be forgotten.
- Vendor logs: ask what the platform itself retains for debugging and whether that can be shortened.
- Bookkeeping data such as invoices follows the Swedish Accounting Act instead, and is not covered by this deletion schedule.
Automate the deletion. A retention policy that depends on someone remembering to clear a folder is not a policy, it is a hope. Most platforms can expire recordings on a schedule; if yours cannot, that is a reason to switch off recording entirely.
Processor agreements with the vendor
Your AI phone provider processes personal data on your behalf, which makes them a processor and you the controller. Article 28 requires a written data processing agreement. Most serious vendors have one ready to sign; if a supplier cannot produce it, you have your answer about the rest of their compliance. Read for these points in particular:
Where the data lives
Which country hosts the audio, transcripts and model calls. Transfers outside the EU and EEA need a valid mechanism such as standard contractual clauses plus a transfer impact assessment.
Sub-processors
Speech recognition and language models are often third parties. The agreement must list them and give you a right to object when the list changes.
No training on your calls
Ask explicitly whether your callers' voices or transcripts are used to improve the vendor's models. The default should be no.
Deletion on exit
What happens to the data, the prompts and the call history when you cancel, and how quickly it is erased.
This is also the point at which to check whether the provider is subject to EU AI Act obligations. A booking receptionist is not a high-risk system, but the transparency duty to tell people they are talking to an AI applies from the start. Our own setup is described on the AI receptionist page, including where calls are processed.
A compliant greeting script
The greeting has to do four things in the first sentence or two: identify the business, say that an AI is answering, state what happens to the conversation, and give the caller an exit to a human. Here is a version that works in Swedish service businesses and takes under ten seconds to say:
- "Hi, you have reached [company]. I am an automated assistant that can book appointments and answer common questions."
- "This call is transcribed so we can save your booking; it is not recorded. You can read more at [company].se/privacy."
- "If you would rather speak to a person, say so at any time and I will pass you on."
- Then the ordinary flow: "How can I help you today?"
When you do not need this at all: if your AI only plays a menu and takes a message, like a smarter voicemail, the data risk is the same as your existing voicemail and a short notice is enough. And if your calls routinely contain sensitive details, for example a therapy practice or a legal helpline, an AI answering service may not be the right purchase regardless of how it is configured; a human line with a good booking page is safer. We would rather say that on a short call than after installation.
- AI receptionistHow our receptionist handles recordings, transcripts and summaries, and what the setup includes.
- Writing the call scriptTurn your ten most common calls into a script with clear hand-off rules.
- Book a free 15-minute callBring your privacy notice and your call types; we walk through what needs to change.
Frequently asked questions
Do I need the caller's consent to record calls in Sweden?
Not necessarily. Under Swedish criminal law a party to a call may record it, but GDPR still governs what you do with the recording. Most businesses rely on legitimate interest with a documented balancing test and a clear notice at the start of the call. Consent is only the right basis when the caller can genuinely say no and still be served, which is rare on a booking line.
Must the AI say that it is an AI?
Yes. The EU AI Act's transparency rules require that people are told when they interact with an AI system, and Swedish practice under GDPR requires that information about processing is given at collection. Put both in the greeting, and keep an easy path to a human.
How long can we keep the recordings?
As long as the purpose requires and no longer. For a booking line that is typically until the appointment has taken place, or a short rolling window if you review calls for quality. Write the period down, automate the deletion, and include summaries in your routine for erasure requests.
What if a caller mentions a medical condition?
Health information is a special category and needs an Article 9 exception to process. Design the flow so that the AI books the appointment and hands anything medical to a person, and make sure summaries do not store the detail. For clinics this is the single most important configuration decision.
Want the receptionist set up the compliant way from day one?
Fifteen minutes with an engineer: we go through what your calls contain, what should be stored, and how the greeting and deletion rules should read for your business.
Book a free 15-minute call