This guide explains the principles; it does not replace a lawyer. The exact rules depend on the country where the company and the called people are located; check them for your case.

Who is responsible for the data

In a call handled by a voice agent, there are two roles:

  • the controller is the company that decides why and how calls are made, for example the clinic or the shop (GDPR, art. 4 para. 7);
  • the processor is the platform that runs the agent on behalf of the company (art. 4 para. 8).

The relationship between them is set out in a data processing contract, with the content required by article 28: the subject matter and duration, the types of data, instructions, confidentiality, security, sub-processors, deletion at the end, and the right to check.

The information obligations and the choice of legal basis remain with the controller. The platform helps with this, but does not take them over.

The basis for recording

Recording a call is data processing and needs a basis under article 6 paragraph (1). In practice, the following are used:

  • performance of a contract (lit. b), when the call relates to an order or a service requested by the person;
  • a legal obligation (lit. c), when a law requires the retention of conversations;
  • legitimate interest (lit. f), for example proof of a confirmation, following a written assessment showing that the person's rights do not override it;
  • consent (lit. a), when no other legal basis fits. It must be able to be withdrawn as easily as it was given (art. 7 para. 3).

Some jurisdictions, including outside the European Union, require the consent of all participants to record a call, regardless of the data protection basis. If you call in several countries, check each country.

The notice: what, when, how

Article 13 requires that the person be informed at the moment the data is collected. For a call, that means before recording starts, not at the end and not in an email sent the next day.

A spoken notice cannot contain the entire privacy policy. Layered information is used:

  • at the start of the call: who the controller is, that the call is being recorded and for what purpose, where the details can be found;
  • in the privacy policy: the basis, recipients, transfers, retention period, rights and the right to lodge a complaint (art. 13 paras. 1 and 2).

The notice must be short, clear and in the language of the conversation.

Say that an AI agent is speaking

Regulation (EU) 2024/1689 on artificial intelligence provides, in Article 50(1), that systems made to interact directly with people must be designed so that people are informed that they are interacting with an AI system, unless this is obvious. The application timetable is set out in Article 113; check it for the date you launch.

Even where it is not mandatory, saying from the outset that a virtual assistant is speaking avoids the sense of deception and later complaints.

Outbound calls and the right to object

When the agent calls for direct marketing, the person may object at any time, and the data is no longer used for this purpose (Article 21, paragraphs 2 and 3). The right must be brought expressly to the person’s attention no later than the first communication, separately from other information (Article 21, paragraph 4).

In addition, many countries have their own rules for unsolicited commercial calls, sometimes with mandatory prior consent. For an agent, this means:

  • only lists of people for whom you have a basis;
  • a phrase in the scenario that accepts refusal without insistence;
  • removing the number from future campaigns after a refusal.

Automated decisions

The person has the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them (art. 22). An agent can collect information for a loan, a policy or employment; a person makes the decision, and the person may request their intervention.

How long you keep recordings

Data is kept only as long as necessary for the purpose (Art. 5(1)(e)). Set a written term for each type of data: the audio recording, the transcription, the summary, the extracted fields. It does not have to be the same; a transcription may be useful for longer than the sound.

Voice as biometric data

A voice recording does not automatically become biometric data. It becomes biometric data when it is technically processed to uniquely identify or authenticate a person (Art. 4(14)), in which case it falls under the special categories regime (Art. 9). If you use the voice to recognise the caller, treat it as such.

Impact assessment

Article 35 requires an impact assessment before high-risk processing, in particular systematic evaluation of individuals based on automated processing, large-scale processing of special categories of data, or systematic large-scale monitoring of a publicly accessible area. An agent for a clinic or for financial decisions is a serious candidate.

Transfers, security, incidents

  • Transfers: if the platform suppliers are outside the European Economic Area, ask for the transfer mechanism, usually the European Commission's standard contractual clauses (art. 46 para. 2 lit. c).
  • Security: technical and organisational measures appropriate to the risk (art. 32): limited access to recordings, logs, encryption in transit.
  • Incidents: the controller notifies the supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of the breach, except where it does not pose a risk to persons (art. 33).

How Kallina works

  • The telephone announcement. From 9 September 2026, on calls that pass through the Kallina telephone server, the recording announcement is spoken by the server, before recording starts, not from each agent's text. This way it does not depend on who wrote the scenario.
  • Evidence on the call. The server notes on each call that the announcement was spoken and in what language.
  • Roles. For your agents' calls, you are the controller; Kallina is the processor, based on a data processing agreement.
  • Suppliers. The list of those who process data for the service is public, on the subprocessors page.
  • Data subjects' requests. Exporting or deleting data linked to a phone number is done at your request, through our team.

Checklist

  1. You have established who the controller is and have the signed processing agreement.
  2. You have a written basis for each type of call.
  3. The announcement is played before recording, in the language of the conversation.
  4. The person finds out they are speaking with an AI agent.
  5. The privacy policy contains everything required by Article 13.
  6. The scenario accepts refusal and objection, and numbers are removed from lists.
  7. No decision with legal effect is made by the agent alone.
  8. There are retention periods by data type.
  9. Have you checked whether you need a data protection impact assessment?
  10. You know where the providers are and which mechanism data are transferred under.