Is an AI receptionist legal in the UK? A plain GDPR guide

It is Monday morning. A customer who rang your salon on Saturday emails: "Was that a robot I spoke to? And what have you kept about me?" You should be able to answer that in a sentence and a link.

The same goes for a salon, a plumber or a takeaway. If an AI receptionist answers your phone, it handles personal data, and you need to be able to explain what happens to it. The ICO's Data Controller Study 2026 found that more than two in three businesses aware of the Data (Use and Access) Act either did not know the law change applied to them or wrongly thought it did not (ICO, June 2026).

This is general information, not legal advice. It summarises guidance from the Information Commissioner's Office (ICO), the UK data protection regulator, as we read it in October 2026. Some ICO pages say they are under review, so check the current versions and speak to a solicitor about your own situation.

Is it legal to use an AI receptionist in the UK?

In general, yes, provided you follow UK data protection law for the personal data it handles and any rules that apply to your sector. We found nothing in the ICO guidance we read that bans answering calls with AI. The usual rules apply: names, numbers and what callers say are personal data.

You are normally the controller, meaning you decide why and how the data is used, and your provider is your processor. The ICO says the contract between you must cover, among other things, processing only on your documented instructions, security, rules for sub-processors, help with people's rights requests, and deleting or returning data at the end (ICO: what needs to be included in the contract). Ask any provider for its terms before you sign up.

Do you have to tell callers it is an AI?

You have to give callers clear privacy information, and mentioning the AI is the sensible way to do it. The ICO says privacy information must be given at the time you collect the data, and must be concise, transparent, intelligible, easily accessible and in plain language. It must cover, among other things, who you are, your purposes and lawful basis, how long you keep the data, who receives it, any transfers outside the UK, people's rights and their right to complain to the ICO (ICO: right to be informed).

Nobody can hear a full privacy notice on a call, so the ICO describes a layered approach: short notices with the key points, and more detail further in. For a phone line:

• Layer one, the greeting: a short line saying the caller is speaking to an AI assistant for your business, that the call is written up, and where to find your privacy notice.
• Layer two, your website: a privacy notice saying what is kept, why, your lawful basis, for how long, who receives it, any transfers outside the UK, callers' rights and how to complain to the ICO.

We did not find an ICO page that requires a spoken "you are talking to an AI" line in those words. The ICO's right to be informed guidance does say that if you use AI, you should be upfront about it and explain your purposes. The ICO does say, in an answer about AI note-taking tools, that privacy notices should be updated to explain how the tool is used (ICO innovation advice).

Are transcripts different from recordings, and what is your lawful basis?

A recording keeps the audio. A transcript keeps the words. Whichever you keep is personal data, and the same rules apply. Keeping less is usually easier to explain.

You need a lawful basis before you start, and consent is not the only one. On call transcripts made by a third-party supplier, the ICO says consent must be freely given, specific and informed, is unlikely to be obtained through a privacy policy, and may not be the most suitable basis. Consider all the lawful bases, and write down why you chose yours. For special category data such as health, you also need a separate condition under the law. The ICO says that if you rely on consent for this, it must be explicit consent.

The ICO also says customers should be told that a third party will process their information, and that when you use an AI tool you must check its outputs are accurate and correct anything that is not. So someone should read the call summaries.

If you cannot explain in two sentences what your receptionist keeps, your callers cannot understand it either.

Callers volunteer things like an allergy or a recent operation. Decide in advance who reads those transcripts and how long you keep them.

Do you need a risk assessment before you switch it on?

Quite possibly. A data protection impact assessment (DPIA) is a written look at the risks of a type of processing. The ICO says that in "the vast majority of cases" the use of AI will involve processing likely to result in a high risk, so a DPIA will be needed. You decide case by case, and if you decide you do not need one, you still need to document how you made that assessment (ICO: accountability and governance in AI).

For a small business, we think a short written note is a sensible start: what the receptionist collects, why, who sees it, where it goes, how long you keep it, and what could go wrong. A solicitor can tell you whether yours needs more.

What if a caller asks for their data, or complains?

Anyone can ask what you hold about them, including call transcripts. The ICO says a subject access request can be made verbally or in writing, including through social media. You must respond without undue delay and at the latest within one month, extendable by up to two further months where necessary for complex requests or several requests from the same person. In most cases you cannot charge a fee, and you must make a reasonable and proportionate search (ICO: a guide to subject access).

Complaints are now a duty too. In an article dated 23 June 2026 the ICO said all organisations handling personal data must give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate it and tell the person the outcome. One email address in your privacy notice and a simple log is a practical start.

What does VolaVoice do, and what stays with you?

VolaVoice does not keep audio recordings. It writes each call up as a transcript and summary on your dashboard. The receptionist is set up to answer only from facts you have approved, and when it does not know, it takes a message. It can still get things wrong, so check the summaries. It takes booking requests that your team confirms. It identifies itself as an AI when a caller asks and never claims to be human. By default it also says so at the start of the call; you can switch that announcement off in settings, but then you need to tell callers another way. You can hear the receptionist answer a call.

VolaVoice's privacy page (dated 4 October 2026 when we read it) says that for callers' data the customer is the controller and Volapos Ltd processes it on the customer's behalf. It also says some suppliers are outside the UK, and that retention periods are still being finalised. Before you rely on any of this in your own paperwork, ask us for what is in place today. None of that makes your business compliant by itself: the lawful basis, notice and retention period are still yours to set.

What is your practical checklist?

• The greeting tells callers they are speaking to an AI assistant.
• Your website privacy notice covers phone calls: what is kept, why, for how long, who receives it and any transfers outside the UK.
• You have your provider's data processing terms in writing.
• You have chosen a lawful basis and written down why.
• You have a plan for health details, including who can read transcripts.
• You have done a DPIA, or written down why you do not need one.
• You have set a retention period your provider can delete on.
• You can find a caller's transcripts and give them a copy within a month.
• You have paid the ICO data protection fee, unless you are exempt.
• Your notice names a way to complain, and each complaint is acknowledged within 30 days.
• Someone reads the call summaries and corrects mistakes.

So what is the honest takeaway?

An AI receptionist can sit comfortably within UK data protection law, but only if you do the homework: tell callers, record your lawful basis, get a written contract, assess the risks and be ready for requests.

The trade-offs are real. Some answers depend on your provider, some ICO guidance is under review, and we are not lawyers, so ask a solicitor about anything that matters. When you are ready to compare plans, see the pricing page.