GDPR & Data Protection
If you take calls from people in the UK or EU, GDPR applies to the personal data your agent captures — names, phone numbers, addresses, and the contents of recordings and transcripts.
⚠ Note: This article describes platform capabilities relevant to data protection. It is not legal advice, and it does not constitute a compliance assessment of your specific business.
Your Role
In GDPR terms you are generally the data controller for the personal data captured on your calls: you decide why it is collected and what happens to it. That means the obligations to have a lawful basis, to inform callers, and to respond to data subject requests sit with you.
Lawful Basis
You need a lawful basis for processing. For an inbound enquiry, legitimate interests or steps preparatory to a contract commonly apply — a caller who rings to book a service reasonably expects their details to be recorded. Marketing use of those details is a separate question with a higher bar. Document the basis you are relying on.
Transparency
Callers must be told what happens to their data. In practice this means a privacy policy covering call recording and transcription, retention periods, any third parties involved, and how to exercise their rights — plus a spoken disclosure at the start of the call pointing to it.
💡 Tip: The spoken disclosure and the written privacy policy have to agree. A greeting that mentions recording while the policy is silent on it is a gap that shows up precisely when someone complains.
Data Subject Rights
Callers can request access to their data, correction, erasure, or restriction of processing. To handle these you need to be able to locate everything relating to one person — which in practice means searching call logs by phone number, and knowing that recordings, transcripts, and lead records all form part of the response.
Retention
GDPR requires that personal data is not kept longer than necessary. Retention windows are configurable per data type and applied automatically, so recordings and transcripts can expire on schedules appropriate to each. Set these deliberately — indefinite retention is difficult to justify.
Account Deletion
Account deletion is supported, with a controlled cleanup process rather than an immediate wipe. If you are relying on deletion to satisfy an erasure obligation, confirm the timeline and scope in advance rather than at the moment you need it.
Checklist
- Identify and document your lawful basis
- Publish a privacy policy that specifically covers call recording and transcription
- Disclose recording verbally at the start of calls
- Configure retention windows and be able to justify them
- Have a documented process for responding to data subject requests
- Confirm the arrangements in place with each processor in your chain