PIPELINEGuide
AI phone assistant and data protection: what GDPR requires
As soon as personal data is processed with an AI phone assistant, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed with an AI phone assistant, you need a legal basis, purpose limitation, defined deletion periods, notification of data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for an AI phone assistant: a data processing agreement with each involved service provider, verification of where processing takes place, a documented retention period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined retention period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Does the assistant understand dialect?
Austrian standard German and moderate dialect reliably, heavy dialect not always. That's why we build in follow-up questions: when unclear, the assistant asks rather than guessing. Critical information like phone numbers is repeated for confirmation.
Can it enter appointments in our calendar?
Yes, in Google Calendar, Microsoft 365 and common industry calendars. You set available slots, buffer times and blocked times, the assistant only books within these rules.
What happens in an emergency?
You define keywords — for an installation business, for example, “water damage” or “no hot water”. When these come up, the call is immediately transferred or a number is called, instead of writing a log.
Do we need a new phone system?
No. In most cases, call forwarding on no answer is sufficient. If you have a cloud phone system, it's even more direct.
How long until it's good?
After the trial phase, standard cases are handled. The fine points — rare requests, unusual phrasings — are added in the first four to six weeks.
Do callers notice they're speaking with an AI?
Yes, and that's how it should be. The assistant says at the beginning that it's a digital assistant — the EU AI Act has required this since August 2026 and it prevents trouble. In practice, hardly anyone minds as long as their request is handled.
Can it run only in the evenings and on weekends?
Yes. Many businesses activate the assistant only outside office hours and when the line is busy. That's the most affordable option and still covers the majority of lost calls.
05 — Next
Related pages
- AI phone assistant — overview
- AI phone assistant — how it works
- AI phone assistant — cost effectiveness
- AI phone assistant — AI disclosure
- AI phone assistant — process
- AI phone assistant — measuring success
- AI phone assistant — implementation
- AI phone assistant — small businesses
- AI chatbot
- Online appointment booking
- Customer support automation
- All guides
AI phone assistant by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.