Call recording and GDPR: a practical guide

Yes, you can record calls made by an AI voice agent in line with GDPR, but only if the person is informed at the start of the call, you have a documented legal basis for each purpose, and you keep only the data you need, only for as long as you need it. Your business, as the controller, decides whom the agent calls and what happens to the recording. The platform provides the tools (the announcement, restriction lists, access to recordings), but responsibility for using them stays with you.

Key idea

This is not legal advice. The guide explains in practical terms how GDPR applies to automated calls. It does not replace a lawyer’s opinion, especially on the legal basis and in regulated sectors. Check every important decision with your legal adviser.

The principles below apply across the EU. National rules on electronic communications and direct marketing differ from country to country, so the details for the countries you call into are part of the conversation with your lawyer.

Who is responsible for what: controller and processor?

The first question in any audit is always: who decides? With a voice agent, the answer is clearly split.

The relationship between the two companies is governed by a data processing agreement, the DPA (in Romanian), accepted online when you sign up. Your instructions are, in effect, the configuration in the platform: scenarios, scripts, lists, calling hours and the recording option. That is why what you tick and write there matters.

CyberSkill also has a second, separate role: it is the controller for data about website visitors and people who request sign-up. The technical measures are described on the security page.

How do you inform the person at the start of the call?

Informing people is the simplest rule and the easiest one to forget. If you switch on recording or transcription, the agent should say two things in the first seconds, before it asks for or receives any information:

1. who it is: your business’s virtual assistant (it never pretends to be human);
2. that the call is recorded.

An example opening, to adapt:

Key idea

“Good afternoon, this is Anna, the virtual assistant of Company X. This call is recorded. I’m calling to confirm the order you placed today.”

A few common-sense rules for the announcement:

• Short. One sentence about recording, not a legal paragraph read out in one breath.
• Before any data. Do not ask for a name, address or case number before the announcement.
• Purpose in the first sentence. The person should know quickly why you are calling.
• Full information within reach. The announcement on the call does not replace full information (purpose, legal basis, retention period, rights). That must exist somewhere the person can reach, such as your privacy policy.

You approve the announcement text and are responsible for it, as the DPA sets out. You can hear it in the test call, before the agent calls anyone.

What is the legal basis? A question for your lawyer

GDPR requires every processing activity to have one of the legal bases in Article 6. For automated calls, the discussion usually revolves around three:

• Performance of a contract. The call serves something the person has already asked for, such as confirming an order they placed or an appointment they booked.
• Legitimate interest. The call pursues a genuine interest of the business (for example, collecting a document needed for an open case file) after you have weighed the impact on the person. It must be documented.
• Consent. Usually required when the call is marketing and the law demands it.

Watch the line between a service call (linked to something the person started) and a marketing call. Marketing calls carry extra rules, including national electronic communications legislation, and the DPA explicitly requires you to follow them. Do not use the agent for unsolicited marketing calls without consent where the law requires it.

Key idea

What we cannot do for you: choose the legal basis. You choose it, per purpose, with a lawyer, and record it in your record of processing activities.

The same logic applies to the recording itself. Having a basis for the call does not automatically give you one for keeping the audio. Ask yourself why you need the recording: quality checks, proof of a confirmation, handling a complaint. If a purpose cannot be stated clearly, you probably do not need to record for it.

Data minimisation and retention: keep little, and only as long as needed

Minimisation means the agent and your lists contain only what the call needs.

In the contact list:

• usually a name, a phone number and, if the scenario needs it, an order or case number;
• avoid “just in case” fields such as date of birth, national ID numbers or full addresses if the agent does not use them.

In the agent’s instructions:

• do not have it ask for special category data (health, beliefs, ethnic origin, biometric data). The DPA explicitly says such data must not be requested by the agent or uploaded to the platform, unless otherwise agreed in writing after an assessment;
• if the person spontaneously says something sensitive during the call, that content ends up in the recording and the transcript. You need an internal rule for what you do with such calls, including deleting them.

Retention is how long you keep recordings and transcripts. Under our documents, they are kept for the period you set as controller, and at most for the duration of the contract. You can ask in writing at any time for specific data to be deleted, and when the service ends, data is returned or deleted as the DPA provides.

You choose the period. A practical way to set it:

1. Write down why you keep the recording (quality, proof, complaints).
2. Decide how long it stays useful for that purpose.
3. Record the period in your internal policy and in the information you give people.
4. Schedule a periodic check and request deletion of data that has passed the period.

Data subject rights: access, erasure, objection

The person called can ask for access to their data (including the recording), rectification, erasure, restriction or portability, or can object. Because your business is the controller, requests usually come to you, and you answer within the legal deadline.

What you have to work with:

• In the portal: you can listen to recordings, read transcripts and restrict numbers.
• On written request: operations you cannot do yourself, such as permanently deleting a recording or extracting all data about one person, are carried out by CyberSkill at your request. The DPA provides that we help you so you can answer on time.
• Requests sent to us: if someone writes directly to contact@agentvocalai.ro, we forward the request to the business on whose behalf the agent spoke, and we do not answer it on the merits ourselves.

Prepare an internal route in advance: who receives the request, who finds the call in the portal, who replies and how quickly. An access request for a recording is far easier to meet when calls can be searched by phone number and date.

Do-not-call lists, calling hours and calls to minors

Three hygiene rules that are more about respect for the person than about paperwork.

“Don’t call me again” means no. The person can say it at any time, including to the agent during the call. The number goes onto the restriction list, and the list is checked before every automated call, SMS or WhatsApp message. Add requests received through other channels (email, phone, forms) to the same list. The content of the list is your responsibility.

Calling hours. Set reasonable hours in which the agent may call. Outside them, the call waits for the next allowed slot. Choose the hours by thinking about how you would feel getting a call at that time, not just about what is technically possible.

Retries in moderation. You set the cadence (when the agent tries again and how many times). A small number of attempts at different times is fairer and works better than persistence.

Calls to minors: avoid them. The agent does not check the person’s age. If your list contains numbers of minors or people under guardianship, stricter rules apply and you need a legal assessment. The simplest approach is to leave such contacts out of automated campaigns and handle separately the cases where the contact is a parent or legal representative.

The checklist before launch

Go through this list before the agent calls real people. If a point has no clear answer, stop and clarify it.

Roles and documents

• I accepted the DPA at sign-up and I know who in the business manages it.
• I recorded the purpose of each campaign and the chosen legal basis, checked with our lawyer.
• Our privacy policy mentions calls made by a voice agent and their recording.

Informing the person

• The agent introduces itself as a virtual assistant and announces recording at the start, before any data.
• I listened to the announcement in a test call and it sounds natural.

Data

• The list contains only the fields the agent needs.
• The agent does not ask for special category data.
• We set the retention period for recordings and transcripts, and who checks it.

Rights and restrictions

• I know how we receive and handle a request for access, erasure or objection.
• The do-not-call list is loaded and has an owner.
• Calling hours and the number of retries are set.
• Contacts who are minors or under guardianship are excluded from campaigns.

Access

• Only colleagues who need it have access to recordings, and two-step verification is on where the platform offers it.

What comes after this list?

GDPR is not solved once, with a tick. Review the information, the lists and the retention periods whenever you add a new scenario or a new category of contacts. When you are ready to launch, continue with the full AI voice agent launch checklist, where compliance is one step in a wider path. For what the agent says when it does not know an answer, see how to prepare the knowledge base. To hear a call with a recording announcement, listen to a demo.