An AI phone agent creates personal data on every call: a phone number, a voice, a transcript and often a name, an address or the reason someone needs help. UK GDPR applies to all of it. The good news is that the rules are familiar if you already record calls — they just need applying deliberately.
This guide is general information, not legal advice. If you handle health, financial or other sensitive data, involve your data protection lead early.
Who is responsible for what
When you use Narvin to answer your calls:
- You are the controller. You decide why calls are handled, what is captured and how long it is kept.
- We are the processor. We handle caller data on your instructions to provide the service.
That split is set out in a Data Processing Agreement (DPA), which is available on request. Your privacy notice should explain to callers that you use an AI service provider to handle calls.
Pick a lawful basis
Most businesses rely on one of these for recording and transcribing calls:
- Legitimate interests — for example, keeping an accurate record of what was agreed, training and quality. Document a short legitimate interests assessment.
- Contract — where the call is needed to deliver something the caller asked for, such as booking an appointment.
- Legal obligation — where a regulator requires you to keep call records.
Consent is rarely the best basis for recording in a business setting, because it must be freely given and as easy to withdraw as to give.
Tell callers, at the start
Transparency is not optional. A good opening line covers three things in a sentence or two:
“Hi, you’ve reached Harbour Lettings. I’m the office’s AI assistant. Calls are recorded and transcribed to help our team — how can I help?”
Then link to your full privacy notice from your website and any confirmation messages.
Special category data needs extra care
Health information is special category data. If your agent books physiotherapy, dental or clinic appointments, callers will mention symptoms. You need an additional condition under Article 9 — for healthcare providers this is often the provision of health or social care — and you should:
- Capture only what the booking needs (for example, “routine check-up” rather than a full description)
- Shorten retention or switch audio recording off on sensitive lines
- Restrict who on your team can open transcripts
Keep data only as long as you need it
Set a retention period and stick to it. In Narvin, retention is set per agent, from 7 days up to a year or indefinitely, and transcripts and recordings are deleted automatically when they expire. Audio recording is optional for each agent. Delete what you do not need; the safest data is data you no longer hold.
Consider a DPIA
A Data Protection Impact Assessment is required where processing is likely to be high risk. Using new technology such as AI on calls that involve sensitive data, vulnerable callers or large volumes is a strong signal to do one. A DPIA does not need to be long: describe the processing, the risks to callers and the controls you have chosen.
Handle access and deletion requests
Callers can ask for a copy of their data, including recordings and transcripts, and ask for it to be deleted in some cases. Make sure your team knows how to find a caller’s records by phone number and date, and respond within one month.
International transfers
Check where your providers store and process data. Narvin primarily stores data in UK or EU/EEA data centres, and where a transfer outside these regions is needed we use approved safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.
Checklist
- Controller and processor roles agreed, DPA in place
- Lawful basis chosen and documented
- Opening line tells callers about AI and recording
- Privacy notice updated to mention AI call handling
- Article 9 condition identified if health data is likely
- Retention period set per agent; audio recording off where it is not needed
- Access to transcripts limited to the right people
- DPIA completed for higher-risk use
- Process for access and deletion requests
See how controls work in practice on our security and data page.
