UK GDPR and AI receptionists: what small businesses need to know

Running an AI receptionist means processing personal data — callers' names, numbers, enquiries, call recordings. UK GDPR applies, but the obligations are tractable when you understand who owes what.

The roles

• You (the business) are the data controller — the calls come to you, for your purposes.
• We (Agentric/Sequel AI Ltd) are your data processor — we handle that data on your instructions, under the Data Processing Agreement in your dashboard.
• Callers are data subjects with rights over their data.

Your lawful bases (the honest version)

• Legitimate interests — answering inbound enquiries is a clearly legitimate business interest, and callers who ring a business expect it to be answered. This covers most of the handling: answering, answering questions, booking appointments.
• Contract — where a caller becomes a customer, the records support the contract.
• Consent — needed only where you go beyond service (e.g. marketing follow-ups). The AI receptionist itself doesn't need consent to answer.

What you're responsible for

• A privacy notice — your landing page links one automatically; if you have your own site, add a privacy link there too.
• Transparency — AI disclosure at call start handles this (done for you).
• Retention — you set how long recordings/transcripts are kept (Settings); keep it honest and defensible.
• Data subject rights — if a customer asks for their data or deletion, our tools let you action it — and the Data Deletion page explains the flow.
• Using it for what it's for — the data is for answering enquiries, not building marketing lists without consent.

What we handle for you

• AI disclosure wording at call start.
• Recording disclosure in the greeting.
• DPA between you and us.
• Sub-processor list published on the site.
• No training of foundation models on your data — contractual and technical.
• DSAR tooling to export/erase contact records.

The honest bottom line

UK GDPR for an AI receptionist isn't exotic: it's normal controller/processor hygiene with one extra step — telling callers they're talking to an AI, which we do. The ICO's AI guidance is the reference; our privacy documentation is written to it. When in doubt, proportionality and transparency are the right instincts.