AI Phone Assistants and GDPR: What You Need to Know in 2026
Can an AI answer your customer calls? Learn which GDPR rules and EU AI Act obligations apply in 2026, with a practical checklist for privacy-compliant AI telephony.
Even the first spoken word on a phone call can be relevant under data protection law. Sounds exaggerated? It isn't.
AI phone assistants are everywhere in the DACH region right now. Appointment booking, order status, customer questions: much of it can be automated today. And that's a good thing. But: Many companies deploy this technology without seriously dealing with the legal requirements. In 2026, that becomes a problem.
Because the GDPR was only the beginning. From August 2, 2026, the transparency obligations of the EU AI Act (Article 50) apply, and they change the rules for everyone who uses AI in direct communication with people. Anyone who doesn't comply risks heavy penalties: up to €15 million or 3% of worldwide annual turnover. For particularly serious violations, even up to €35 million or 7%.
Can an AI answer my customer calls at all?
Short answer: Yes. But there are conditions.
Article 6 of the GDPR sets out the possible legal bases. For most AI telephony scenarios, two of them apply:
When the call is directly related to a contract: booking an appointment, confirming an order, following up on an ongoing job.
E.g. efficient customer communication. But be careful: the caller's interest carries a lot of weight. A balancing test is mandatory.
And this is exactly where it gets very concrete from August 2026. Article 50 of the EU AI Act states: anyone who deploys an AI system intended for direct interaction with people must inform those people in advance. Not somewhere in the fine print, but clearly, unambiguously and at the start of the conversation. That's not a recommendation, it's an obligation.
Recording vs. transcription: Isn't that the same thing?
Honestly, I see this misconception all the time: "We don't record, we only transcribe." Under data protection law, that unfortunately is no all-clear.
An audio file is stored. The voice can count as biometric data (Art. 9 GDPR). Highest level of protection. Explicit consent is usually required. Section 201 of the German Criminal Code protects the privately spoken word.
Speech is converted to text, audio is deleted immediately. No biometric link remains. Significantly less invasive, but personal data is still processed.
What does that mean in practice? Delete audio immediately after transcription. Don't keep permanent audio storage. Don't create voiceprints. No emotion recognition.
By the way, the secrecy of telecommunications (TDDDG § 3) also plays a role here. Call content may only be processed with a legal basis, even when the processing is fully automated.
Checklist: 7 points for GDPR-compliant AI telephony
Okay, enough theory. Here are the seven things you need to take care of in practice:
Legally mandatory from August 2026 under the EU AI Act (Art. 50). But even now: just do it. The caller needs to know they're speaking with an AI.
For every processing step you need a legal basis under Art. 6 GDPR. Performance of a contract, legitimate interest, consent, depending on the use case. Document it beforehand.
With an external AI phone assistant: a DPA under Art. 28 GDPR covering purpose, duration, types of data, TOMs and a list of sub-processors.
Ideal case: data processing in the EU, even better in Germany. With US sub-processors: check for an adequacy decision or standard contractual clauses.
Delete audio immediately after transcription. Store transcripts only as long as necessary. Configurable retention periods are a must, not a nice-to-have.
For systematic processing of call data by AI, a DPIA under Art. 35 GDPR is usually mandatory.
The EU AI Act prohibits manipulative AI techniques. No emotion recognition. No ranking of callers. No political opinions expressed by the AI.
What often gets overlooked
Your provider's GDPR compliance alone isn't enough. As the company, you are the controller. And you can still use a technically flawless solution unlawfully:
The technology has to be right, but so does the way it's used. It's like a car with a valid inspection sticker: it still won't stop at a red light on its own.
What ScaleTalk does for data protection
Instead of a long feature list, a few things that set us apart from many providers:
We don't audit ourselves. Specialized external partners regularly audit our data protection processes.
Transparent and publicly available.
Server locations in Germany and the EU. With US sub-processors: Data Privacy Framework or standard contractual clauses.
Audio is deleted immediately after transcription. No permanent audio storage. No voiceprints. No emotion recognition. No profiling.
Our privacy policy and DPA are publicly available. You can find them at app.scaletalk.ai/privacy-policy.
Conclusion
AI telephony and data protection are not mutually exclusive. But they require you to take the topic seriously, as a provider and as a user.
2026 brings new rules with the EU AI Act. The transparency obligations from Article 50, the ban on manipulative techniques, the stricter requirements for AI systems: none of this is a distant future scenario, it takes effect in just a few months. Anyone who relies on a solution that builds in data protection from the start now will save themselves a lot of trouble later.
And yes: a few hundred euros in fines is one thing. But the loss of trust among your customers weighs much more heavily.
Start GDPR-compliant: try ScaleTalk for free now
AI telephony that builds in data protection from the start. Audited by DataGuard. Servers in Germany.