When an AI agent answers your phone or your website chat, it handles your customers’ personal data: names, phone numbers, what they need and sometimes a recording of the call. The GDPR applies exactly as it does to your own staff and systems.
This guide covers what that means in practice, the questions to ask any AI provider, and the AI Act rules that came on top in 2026. It is general information, not legal advice.
What the GDPR means for an AI agent
Under the GDPR you remain responsible for your customers’ data, even when an AI provider processes it for you.
You are the controller. You decide why and how the data is used. The AI provider is usually your processor (Articles 4 and 28).
You need a legal basis for each use. For answering enquiries, that is often the contract, or steps the caller asks for before one, or your legitimate interest in replying (Article 6).
Tell people how their data is used: in your privacy notice and, for calls, in a short line at the start (Articles 13 and 14).
Collect only what you need, and keep it no longer than needed (Article 5).
Special data needs extra care. Health information, for example in a clinic, is special category data with stricter rules (Article 9).
People keep their rights, including access to, correction of and deletion of their data (Articles 15 to 17).
The data processing agreement
Every provider that handles your customers’ data on your behalf needs a data processing agreement with you.
The agreement sets out what the provider may do with the data, how it is secured, which sub-processors it uses, and what happens to the data when you stop working together. Article 28 lists what it must contain.
Where the data goes
Check where your data is stored and processed, including by the AI models behind the agent.
Sending personal data outside the EEA needs a transfer tool, such as an adequacy decision or the EU’s standard contractual clauses. For the United States, the EU–US Data Privacy Framework covers companies certified under it. The EU General Court upheld it in September 2025, and an appeal was lodged with the EU Court of Justice (Streamlex DPF tracker). Ask which one each provider in the chain relies on.
Ten questions to ask any AI provider
These ten questions show quickly whether a provider takes your customers’ data seriously.
Will you sign a data processing agreement with us?
Which sub-processors handle our data, including the AI models, and where are they?
Is our customers’ data used to train AI models? It shouldn’t be without your agreement.
What do you record and store: audio, transcripts, summaries?
How long do you keep it, and can we decide that?
Who at your company can access it, and is that access logged?
How do we export or delete a customer’s data when they ask?
How is the data secured, both in transit and when stored?
What happens to our data if we stop working together?
How do callers and chat users learn they are talking to an AI, and how do they reach a person?
The AI Act on top
Since 2 August 2026, the EU AI Act adds a transparency rule: people must be told when they are dealing with an AI system, unless that is obvious (Article 50).
For a voice or chat agent, a short line at the start of the conversation covers it. The AI Act doesn’t replace the GDPR: both apply.
How we handle it at Acastia
We go through data protection with you before anything goes live: what the agent records, where it is stored, who can access it and when it is deleted. Our processing terms and our sub-processors are set out in our privacy policy. If a customer asks to see or delete their data, we help you answer the request. See how we work.
Questions and answers
Is it legal to use an AI agent for customer calls in the EU?
Yes, with the right set-up: a legal basis, clear information for callers, a data processing agreement, and telling people they are talking to an AI.
Do I need my customers’ consent?
Not always. Answering someone who contacts you can often rest on the contract or your legitimate interest. Marketing calls are different: automated sales calls need prior consent. Read AI cold calling in Europe.
Can we record the calls?
Recording is processing personal data: you need a legal basis, must tell callers at the start, and should keep recordings only as long as needed. Some countries add their own rules, so check locally.
Do we need a data protection impact assessment?
The GDPR requires one when processing is likely to result in a high risk to people, for example large-scale handling of health data (Article 35). Ask your data protection adviser.
Does the AI provider own the conversations?
It shouldn’t. Under a data processing agreement, the provider processes the data only on your instructions.
