An AI phone assistant is GDPR-compliant when every step of the phone call operates within a verified framework: speech recognition, response generation, and voice output handled by contractually bound data processors; recordings made only with a valid legal basis; retention periods defined by the operator itself; and a clear disclosure that an AI is speaking. Phone calls generate more personal data than chats, as voice and phone number are added to the message content. This article walks through a phone call step by step and shows which questions data protection and IT teams should ask a provider.

At a Glance

• A call generates five types of data: phone number, voice, transcript, summary, and optionally a recording.

• Every processing step requires a known location and a processor documented in the DPA.

• Voice output is the step with its own specialized provider. The critical factor is what this provider receives.

• Recordings are a deliberate decision, requiring a legal basis and prior notification to callers.

• Retention periods are defined by the operator, for transcripts and recordings just as for chats.

• The AI disclosure belongs at the beginning of the call, in every language supported by the hotline.

What Data Is Generated During a Phone Call

A chat consists of text. A phone call generates more:

• Phone number and metadata: calling number, destination number, start time, and duration.

• Voice: the audio signal itself, from which speech recognition extracts the text.

• Transcript: the conversation as text, with speaker roles and timestamps.

• Summary: a concise version of the inquiry for evaluation and further processing.

• Recording: the audio file of the entire conversation, if call recording is enabled.

Added to this is the information the assistant collects during the call, such as customer number, meter reading, or new address. All of this constitutes personal data. Under the GDPR, what matters is who processes this data at which stage and how long it is retained.

Where the Data Is Processed

Technically, an AI phone assistant is a chain of four steps. Each step represents a distinct data protection consideration.

Voice Input. The telephone system routes the call via SIP. Noise cancellation and speech recognition convert the audio signal into text. This is where the voice data originates—and where the greatest risk lies if recognition runs via a third-party speech API whose location is unknown.

Response. The system generates the response from the text, ideally exclusively from verified sources. From a data protection perspective, the key question is whether conversation content is shared with external AI providers in the process.

Voice Output. The response is converted into speech. Many providers rely on specialized voice services for this. The question then becomes which service is used, where it processes data, and what it gets to see.

Storage. The transcript, summary, and, if applicable, recording are stored so the team can trace the interaction. Retention periods, access permissions, and interfaces are decisive here.

Voice Output: What the Provider Sees

For voice output, nearly every voicebot collaborates with a voice provider. This is legitimate, provided two conditions are met.

First, the provider is listed as a sub-processor in the Data Processing Agreement (DPA), and the operator has explicitly approved it. A new provider must not be added quietly via an update.

Second, the provider receives as little data as possible. For voice output, only the text to be spoken is required. The provider does not need the caller's voice. Therefore, ask specifically which data is transmitted to the voice service and which is not.

Recording and Transcript

A call recording is the most sensitive file of a phone call. Anyone recording calls needs a legal basis and must inform callers in advance. In Germany, recording a phone call without consent is also a criminal offense (Section 201 StGB). For many hotlines, the transcript is sufficient, and recording remains disabled.

The following applies to both:

• Retention Period: The operator defines how long transcripts and recordings are retained—from immediately after the call until the end of the contract. A fixed retention period set by the provider does not replace this decision.

• Access: Phone numbers are masked in the user interface, permissions are managed via a role-based access model, and interfaces are accessible server-side only with authentication keys.

• Archiving: Where records must be stored in an audit-compliant manner, an archiving option that fulfills these requirements is necessary.

Notification Requirements on the Phone

The EU AI Act requires that people recognize when they are interacting with an AI system. On the phone, there is no bot icon, so the greeting takes on this role. A single sentence is sufficient, such as: "You are speaking with the digital assistant from Musterwerke Energie."

In addition, the information obligations of the GDPR apply: who is responsible, for what purpose the data is processed, and where callers can learn more. If call recording is enabled, notification of this must also be provided right at the beginning.

If the hotline is multilingual, every notice applies in every supported language. In practice, this means dedicated greeting texts per language and channel, allowing an outage hotline to use a different announcement than general customer service.

Checklist for Provider Selection

These six questions clarify most points before launching a pilot:

1. Where do speech recognition, response generation, and voice output run, and which data processor is listed in the DPA for each?

2. Which voice providers are included by default, and how is an additional provider approved and documented?

3. What data does the voice provider receive?

4. Can recording be toggled per hotline, and what is its default setting?

5. Who defines the retention periods for transcripts and recordings?

6. Can the AI disclosure be configured in the greeting for each language and channel?

How Mercury Voice Implements This

Mercury Voice is a channel of the Mercury.ai platform and operates within the same data protection framework as the chat solution: hosted on AWS in Frankfurt, isolated environments per customer, and no transfers to third countries. Responses are generated using the same research and fact-checking mechanisms as in chat, drawing exclusively from the company's approved sources.

For voice output, Amazon Polly is included in the standard DPA. Additional providers such as Cartesia are only added after an amendment to the DPA, and an authorized person must confirm the approval within the project, which is logged with the user identity and timestamp. The voice provider receives only the text to be spoken—never the caller's voice.

When Mercury Voice transfers a call to a human agent, the recipient receives a brief summary beforehand, including the caller's name, identified intent, and a conversation summary. This internal handover serves the operational purpose of call routing and must be included in the privacy policy, just like team handovers in chat.

Recording can be toggled per voice channel and is disabled by default. Transcripts and recordings follow the retention period configured by the company in the project, just like chat messages. Phone numbers are displayed masked. The greeting text and voice are defined by the team per channel, which also incorporates the AI disclosure. Learn more about how it works in our guide to voicebots for customer service, or view a platform overview on the Mercury Voice page.

Frequently Asked Questions

Is an AI phone assistant GDPR-compliant?

An AI phone assistant processes personal data and is therefore subject to the GDPR. It can be operated compliantly if all processing steps are handled by processors covered by a DPA, no data is transferred to third countries, the operator defines the retention periods, and callers are informed at the beginning of the call.

What does the voice output provider receive?

For voice output, only the text to be spoken is needed. With Mercury Voice, the voice provider receives precisely this text; the caller's voice is not transmitted.

Do I have to inform callers that an AI is speaking?

Yes. The EU AI Act requires that it be clear when an AI system is speaking. On the phone, this is handled by the greeting—and for multilingual hotlines, in every supported language.

Is a voicebot allowed to record calls?

Only with a legal basis and prior notification to callers; in Germany, recording without consent is a criminal offense. With Mercury Voice, recording can be toggled per channel and is disabled by default.

How long are transcripts and recordings stored?

For as long as the company specifies in the project settings—from immediately after the call until the end of the contract. With Mercury Voice, the same retention period applies as for chat messages.

Conclusion

Whether an AI phone assistant operates in compliance with the GDPR depends on the answers to four questions: where each step runs, what the voice provider sees, who defines the retention period, and how callers are informed. Clarifying these questions before a pilot saves time and avoids compliance loops later on. Mercury.ai's security documentation is available in our Security Paper on the EU AI Act.

Looking to automate your hotline in compliance with data privacy regulations? Talk to us.