3. What should an AI receptionist contract say about recordings and customer data?

Recommended questions before launch:

1. What is collected? Separate audio, transcripts, summaries, contact details and diagnostic logs.
2. Why is each item needed? Require a documented processing rationale, lawful basis and retention decision.
3. Who uses it? Identify the contractor, agency, telephony company, model provider and support providers.
4. Does anyone reuse it? Establish whether recordings or transcripts support provider training or another independent purpose.
5. Can the business retrieve and remove it? Test across the actual systems, not only the CRM screen.
6. What happens after termination? Obtain a documented return/deletion process and evidence.

Where the agency is a processor, the contract must address instructions, confidentiality, security, subprocessors, assistance with rights and compliance, end-of-contract treatment and audit information. A supplier deciding its own processing purposes may have a different role for that activity. ICO controller–processor contract guidance.

UK hosting is not the whole international-transfer assessment. Making information accessible to a separate organisation outside the UK can count as a transfer; the ICO’s framework examines legal entities, who initiates the transfer and the applicable protection mechanism. ICO international-transfers guide.

Commercial recommendation: require the supplier to price data retrieval, deletion assistance, incident support and exit work explicitly. Also request a documented assessment of whether a data protection impact assessment is needed, rather than accepting either that every AI project requires one or that none does.