An AI phone assistant can be run in line with the GDPR if six things are in place: a legal basis for every type of call; a clear notice at the start of the call that the caller is talking to an AI (Article 50 of the EU AI Act, applicable since 2 August 2026); consent before recording and transcription where national law requires it; a data processing agreement with every processor; safeguards for any data transfer outside the EU; and short, defined retention periods. This page is general information, not legal advice.
Which legal basis applies?
It depends on why the assistant calls. A call-back after an enquiry is usually a step taken at the request of the person before a contract (Article 6(1)(b) GDPR). Appointment reminders for existing customers rest on the contract or on legitimate interest. Recording and transcription often need consent. Cold calls are a different matter altogether. Our assistant does not make them; it only calls people who asked to be contacted.
The assistant must say that it is an AI
Under Article 50(1) of the EU AI Act, AI systems that talk directly to people must be designed so that the person knows they are interacting with an AI. The duty rests mainly on the provider of the system, but as the company using it you want the same thing: a caller who feels deceived will not book a meeting. Our scripts therefore say so in the first sentence, and offer a person at any time.
Recording and transcription
An AI assistant has to process speech, and a transcript is created for every call. National rules on recording calls differ: in Germany, recording the privately spoken word without consent is a criminal offence (§ 201 StGB). That is why the assistant asks for consent at the start, before the conversation continues. If the caller declines, it offers a call-back by a colleague instead.
Who is responsible for what?
| Party | Role under the GDPR | What it means |
|---|---|---|
| Your company | Controller | Decides on purpose and data; informs callers (privacy notice) |
| Impulsyan | Processor | Builds and runs the assistant on your instructions, under a data processing agreement (Article 28) |
| Voice platform (Retell AI) | Sub-processor | Speech recognition, voice and call handling; covered in the agreement |
| Telephony provider | Sub-processor | Phone numbers and call routing |
Data outside the EU
Several voice platforms, including Retell AI, are based in the United States. A transfer of personal data there needs a valid safeguard: certification under the EU–US Data Privacy Framework or standard contractual clauses. We check and document this in the data processing agreement before going live.
How long is data kept?
As short as possible. We define retention per data type: the summary and outcome stay in your results tracker as long as the sales process needs them; audio recordings can be deleted automatically after a set period; and personal data in transcripts can be redacted on the platform.
Checklist
- Legal basis defined for each call type (call-back, reminder, recording)
- AI notice and recording consent in the first seconds of the call
- Privacy notice for callers on your website, linked from forms
- Data processing agreements with Impulsyan and every sub-processor
- Safeguard for transfers outside the EU documented
- Retention periods and automatic deletion configured
- A person available on request, and no cold calls
This page gives general information and does not replace legal advice for your specific case. For the cost side, see what an AI phone assistant costs.
Frequently asked questions
Do callers have to be told they are speaking to an AI?
Yes. Since 2 August 2026, Article 50 of the EU AI Act requires that people interacting directly with an AI system are informed of it. Our assistant says so in its first sentence.
Do we need consent to record the call?
Often, yes. In Germany, recording the spoken word without consent is a criminal offence under § 201 StGB. The assistant therefore asks for consent at the start and offers a human call-back if the caller declines.
Who signs the data processing agreement?
Your company, as controller, signs a data processing agreement with Impulsyan. We, in turn, have agreements with the voice platform and the telephony provider as sub-processors.
Where are the call data stored?
Summaries and outcomes go into your results tracker or CRM. Audio and transcripts are processed on the voice platform, with retention and redaction settings we agree with you.
Is this legal advice?
No. This page is general information. For your specific situation, we recommend a short review by your data protection officer or lawyer; we provide all the documentation they need.
Sources: EU AI Act (Regulation 2024/1689), Article 50; GDPR (Regulation 2016/679); § 201 StGB (Germany).