Is an AI receptionist legal in the UK? GDPR guide

Owners ask one question about an AI receptionist before price: is it legal? Yes. The work is a few short documents and one sentence in your greeting. This chapter of our complete guide to AI receptionists sets out each rule and the words to use.

Line wrote this guide, and Line sells an AI receptionist. This is general information about UK law on 3 October 2026, not legal advice. If you handle health, legal or financial matters, take advice on your own set-up.

Is an AI receptionist legal in the UK?

Yes. No UK law stops a business using AI to answer its phone. Four sets of rules decide how you do it.

A fifth set, PECR, applies only if an AI makes marketing calls or sends marketing texts. More on that below.

The data rules are not special to AI: a human answering service is your processor too.

What to do this week

Eight jobs, about half a day. Finish them before the AI answers a real call.

The set-up chapter shows where each job fits.

AI receptionist GDPR: what UK data protection law requires

UK GDPR applies to every call your AI receptionist answers. A transcript or recording of a traceable caller is personal data, and so, usually, is their number. That is the core of AI call transcription and GDPR. You are the controller and the provider is your processor, so compliance is your job, whatever the provider's website says.

Which lawful basis should you use?

Legitimate interests, for most businesses. You need a record of the call to deal with the enquiry, and callers expect one. For a quote or booking the caller asked for, "steps to enter into a contract" also fits.

Do not default to consent. The ICO says: "Consent is not the only lawful basis that may be available to the organisation, and may not be the most appropriate basis for the processing related to creating the call transcripts" (ICO). Valid consent needs a real way to say no and still be served, which is hard on a phone line. Write a half-page legitimate interests assessment instead.

Health, criminal and other sensitive details

If callers mention their health or a crime, the transcript holds special category or criminal offence data. You need a second condition on top of your lawful basis: Article 9 for health, Article 10 for criminal offences. If consent is the route, it must be explicit.

Clinics hear symptoms; solicitors hear about arrests. Four steps reduce the risk:

1. Tell the AI not to ask for sensitive detail. Name, number and a one-line reason. A person calls back for the rest.
2. Plan for callers who volunteer it anyway. Cover it in your DPIA and privacy notice.
3. Limit who can read transcripts.
4. Keep sensitive detail out of follow-up texts. A booking text gives the time, not the reason.

What must your privacy notice say?

Callers have a right to be informed. Say that a virtual assistant may answer, what you keep and why, your lawful basis, the provider, whether data leaves the UK, how long you keep it, and how callers use their rights.

Do you need a data processing agreement?

Yes. Article 28 requires a written contract with every processor. The ICO lists eight minimum terms, such as acting only on your instructions, sub-processors only with your written approval, and deletion when the contract ends. Also read the provider's sub-processor list and its clause on training AI models.

How long should you keep transcripts and recordings?

No law sets one period. Keep personal data no longer than you need it, and delete on schedule. Our suggested starting points, not legal rules:

Do you need a DPIA for an AI receptionist?

Often, yes. The ICO lists "the use of new technologies, or the novel application of existing technologies (including AI)" as a high-risk indicator. A DPIA is required when that is combined with another criterion, such as health data, vulnerable people or large-scale processing (ICO). The ICO is reviewing this list.

A small business DPIA is short: what the AI does, the data, the risks (wrong answers, sensitive details, data leaving the UK) and your answer to each. If a provider recognises callers by their voice, that is biometric special category data: plan on a DPIA.

Can a US-based AI provider handle your callers' data?

Yes, if the transfer is covered. Many AI receptionists use US firms for speech, language models or voice. Transfers to US organisations certified under the UK Extension to the EU–US Data Privacy Framework are covered by UK adequacy regulations in force since 12 October 2023. Check each firm on the Data Privacy Framework List. Otherwise you need another safeguard, usually the International Data Transfer Agreement or the UK Addendum (ICO).

What rights do callers have over their transcripts?

The same as over any personal data. A caller can ask for a copy, and you must reply "within one month" (ICO). They can ask you to delete it, correct a misheard detail, or object to your use of it. Choose a provider that finds, exports and deletes all of one caller's conversations by phone number.

Did the Data (Use and Access) Act 2025 change the rules?

Yes, in two ways. Since 5 February 2026, new rules govern solely automated decisions with significant effects. Since 19 June 2026, you must have a data protection complaints process (commencement regulations).

Automated decisions: what counts as significant?

The Act added Articles 22A to 22D to UK GDPR. A decision is solely automated "if there is no meaningful human involvement in the taking of the decision". It is significant if "it produces a legal effect for the data subject, or it has a similarly significant effect" (section 80).

The old general ban is gone. Any lawful basis now works, "so long as you continue to apply appropriate safeguards", except for special category data (ICO). The person must be able to learn about the decision, make representations, reach a person and contest it. Our reading of what is significant:

The rule that keeps you clear: the AI collects, a person decides. The ICO consulted on draft guidance on automated decision-making in spring 2026; check its site for the final version.

The complaints duty

Since 19 June 2026, you must help people complain about how you use their data, "such as providing an electronic complaints form", and "acknowledge complaints within 30 days" (ICO). Put a complaints email or form in your privacy notice.

AI call recording and GDPR in the UK: what to say at the start of a call

Tell callers at the start that the call is recorded or transcribed, and why. That one sentence meets the interception rules and helps meet the UK GDPR duty to inform.

Recording a call as it passes through a phone system is interception. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 allow it for business purposes, such as establishing facts, if the business "has made all reasonable efforts to inform" callers that calls may be intercepted.

Whether an AI that is itself answering the call "intercepts" it is untested. The same sentence covers both cases:

"You're speaking to Hartley Plumbing's virtual assistant. This call is transcribed so the team can follow up."

If the system keeps audio too, say "recorded and transcribed". Voicemail is a recording, and most systems, Line included, transcribe it. Cover it in your privacy notice.

For calls your team takes, read how to record business calls in the UK.

Do I have to tell callers they are speaking to AI?

No UK statute requires it on every call: that is our reading, and Moneypenny's ("There is currently no blanket legal requirement in the UK to disclose AI during a routine business call", Moneypenny). But the CMA, consumer law and the EU AI Act all point the same way, and it costs one sentence. Say it at the start of every call.

What the CMA says about AI agents

The CMA's Complying with consumer law when using AI agents (9 March 2026) says:

• "Consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person."
• "You are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent."
• "Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results."
• "You could be fined up to 10% of your worldwide turnover, and possibly forced to compensate affected consumers."

If the AI quotes a wrong price, you answer for it as if your receptionist had said it.

Consumer law: the DMCC Act 2024

Since 6 April 2025, the unfair commercial practices rules in the Digital Markets, Competition and Consumers Act 2024 apply, with CMA penalties of up to the higher of £300,000 or 10% of worldwide turnover (CMA207). Our reading: an AI that implies it is a person risks a misleading action, if that could change a caller's decision, such as whether to ask for a person.

The EU AI Act, for callers in the EU

From 2 August 2026, Article 50 makes providers ensure that AI systems "intended to interact directly with natural persons" tell people "that they are interacting with an AI system", at the latest at the first interaction (Regulation (EU) 2024/1689).

• It reaches UK firms. Providers outside the EU are covered "if the output of their AI system is used in the EU" (Commission FAQ). Take calls from Ireland or France, and your AI is in scope.
• It is a provider duty. Choose a vendor whose AI says it is an AI in its first sentence. If you build your own voice agent, you may be the provider.
• The "obvious" exception is narrow. The Commission says it "should be interpreted in a restrictive manner". A natural voice makes AI less obvious, not more.
• Penalties reach €15 million or 3% of worldwide turnover, whichever is higher; for small and medium firms, whichever is lower (Article 99).

Do not clone a real member of staff

An AI in the cloned voice of "Sarah from reception" misleads callers. Our reading: AI audio that resembles a real person and would falsely appear authentic is a "deep fake", and Article 50(4) makes the deployer, which is you, disclose it. In September 2025 the ICO fined two energy firms £550,000 between them for marketing calls that used "avatar software, which gave the call recipients the impression they were talking to 'Jo, Helen or Ian' from the UK" (ICO). Give your assistant its own voice and name.

What callers think

Disclosure costs little. In a January 2026 survey of 5,001 UK adults by Censuswide for Moneypenny, a vendor-commissioned study, 54% were comfortable with an AI "that clearly told them from the start what it was", and 68% when it offered a person at any point (Moneypenny).

Does PECR apply to an AI receptionist?

Not to answering calls. PECR controls marketing calls, texts and emails, so it matters only when an AI calls out or sends promotions.

A service message with "elements that are direct marketing, even if that is not the main purpose of your message" counts as marketing (ICO). For automated calls, "General consent for marketing, or even consent for live calls, is not enough" (ICO).

So a missed-call text that asks how you can help is a service message. Keep offers out of it. Since 5 February 2026 the ICO can fine up to £17.5 million or 4% of global turnover under PECR (ICO).

Sector rules for regulated businesses

Solicitors, health care and FCA-regulated firms have rules that reach phone answering. In each, the AI can handle admin, but a person stays accountable.

Solicitors and law firms

The SRA Code of Conduct for Firms applies to call handling. Paragraph 2.3: "You remain accountable for compliance with the SRA's regulatory arrangements where your work is carried out through others." Paragraph 2.5 requires you to manage material risks, and 6.3 to keep client affairs confidential.

The SRA's warning notice on misuse of AI (17 August 2026) says "AI has no separate legal personality", and client information should go into AI systems only "where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality". It is about AI in legal work, but the tests fit a receptionist that hears a client's matter.

In practice, the AI takes the name, number, matter type and the other party's name for a conflict check. It never comments on the case. Confirm the provider does not train models on your calls.

GP practices, dentists and private clinics

The CQC's GP mythbuster 109 sets the benchmark. A GP practice that uses AI must:

• meet the NHS clinical safety standard DCB0160, and check the developer meets DCB0129;
• use the Digital Technology Assessment Criteria (DTAC) when buying;
• name a clinical safety officer, a registered senior clinician;
• tell patients: "As AI technologies are new, you do need to tell people that you are using them";
• keep a non-digital route to care, and human oversight.

An AI tool that "influences clinical decision-making" is likely a medical device under MHRA rules. Our reading: an AI that takes messages and requests appointments is lower risk but still needs a DPIA and a patient notice. One that triages symptoms is in clinical safety territory. Keep the AI to admin, and give every caller the same fixed line, such as "If this is an emergency, hang up and call 999", rather than letting it judge urgency.

FCA-regulated firms

The Consumer Duty guidance FG22/5 names "phone systems, menus or webchats that are difficult to navigate" as a source of harm, and says "it is likely that firms will need a real-time human interface, such as a phone service" for non-standard issues. An AI can answer first, but complaints and vulnerable customers must reach a person easily.

Investment firms under SYSC 10A must record relevant calls, tell clients, and keep records for five years, or up to seven if the FCA asks. Do not assume a transcript meets that rule.

What to say to callers: disclosure, recording and privacy wording

Three pieces of wording cover most businesses: an opening line, a recording notice if you keep audio, and a privacy notice paragraph. Replace everything in square brackets.

What to say where:

Add three things to the privacy template: where the data is processed and the transfer safeguard, how to complain to you, and the right to complain to the ICO. If your provider also writes call summaries or keeps audio, say so.

More greetings are in business voicemail greetings and receptionist scripts.

Questions to ask your provider about data

Ask these ten questions in writing before you sign. They cover AI receptionist data protection end to end.

These questions apply to Line too. Line keeps message conversations in your shared inbox and a transcript of each call its AI receptionist answers. Voicemails are recorded and transcribed. Try Molly demo calls are recorded for 90 days, and the demo says so at the start. Ask us the rest, as you would any provider.

To compare providers, read the best AI receptionists in the UK, or see Line's AI receptionist.

Sources and how we checked them

We checked every source on 3 October 2026, at the ICO, legislation.gov.uk, the CMA, the European Commission, the SRA, the CQC and the FCA. Where we give our own reading of the law, we say so. If a rule has changed, tell us at hello@useline.io.