A supplier’s “GDPR compliant” label is not enough to establish that your deployment is lawful. Review the purpose, personal information, lawful basis, transparency, contracts, retention and access arrangements for the workflow you intend to operate.
The ICO’s AI guidance requires an appropriate lawful basis for processing personal data; using AI does not remove that requirement. Its controller–processor guidance also specifies contractual protections where a supplier processes data on your behalf. (ico.org.uk)
Before launch, require a written deployment record covering:
| Question | Evidence to request |
|---|---|
| Why is each item of information needed? | A purpose and field-level data map |
| Who decides how it is used? | Documented controller, processor and other roles |
| What does the caller learn? | An approved greeting and accessible privacy information |
| How long is it retained? | Separate schedules for recordings, transcripts, logs and customer records |
| Who can retrieve or delete it? | Tested access and request-handling procedures |
| Is a DPIA required? | A recorded screening decision and assessment where needed |
The ICO requires a DPIA for processing likely to create high risk and identifies relevant combinations involving innovative technology. Do not claim that every receptionist automatically requires one—or that a small business never does. (ico.org.uk)
For recorded calls, the ICO’s monitoring guidance says callers must be told that recording occurs and why, with further privacy information available. Review proportionality and employee monitoring as well as customer transparency. (ico.org.uk)
Use current guidance: the ICO’s 19 June 2026 update states that all DUAA data-protection provisions were then in force. (ico.org.uk)
Sources cited on this page
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk