What is GDPR?

What it covers

The General Data Protection Regulation applies to the processing of personal data. Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, which includes a name, an identification number, location data or an online identifier. A voice recording linked to a phone number or account, and a transcript that mentions a name, are both within that definition.

Article 3 sets the reach. It applies to processing in the context of an establishment of a controller or processor in the EU, wherever the processing takes place. It also applies to a controller or processor outside the EU when processing relates to offering goods or services to people in the EU, or to monitoring their behaviour there. A company outside Europe that takes calls from European customers can therefore be covered.

Two roles matter. The controller decides the purposes and means of processing. The processor processes personal data on the controller’s behalf (Article 4(7) and (8)). A business that deploys a voice agent is usually the controller, and the platform and speech vendors it uses are often processors.

What it requires

• Article 5 sets the principles, including that data is kept in identifiable form no longer than necessary for its purposes (Article 5(1)(e)).
• Article 6(1) lists six lawful bases for processing: consent, contract, legal obligation, vital interests, public interest, and legitimate interests. A controller needs at least one for each purpose.
• Article 9 prohibits processing biometric data used to uniquely identify a person, and data concerning health, unless an exception applies, such as explicit consent.
• Article 13 requires the controller to tell people who it is and why it processes their data at the time it collects it.
• Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.
• Article 28 requires a contract between controller and processor that, among other terms, has the processor act only on documented instructions.
• Articles 44 to 49 allow transfers of personal data outside the EU only when the conditions of that chapter are met.
• Article 83(5) allows fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for breaches of the basic principles, data subject rights and transfer rules.

The regulation does not create a general “GDPR certified” status. Article 42 allows approved certification mechanisms, and Article 42(4) says a certification does not reduce the responsibility of the controller or processor.

What it means for a voice agent

Pick a lawful basis for each thing a call produces, and tell callers early. That is one more reason a short spoken notice at the start of a call is common. Settle how long recordings and transcripts live (data retention) and whether the vendor keeps nothing at all (zero data retention).

Check where audio goes. A speech vendor, an LLM provider and a telephony carrier may each process the call in different countries, and each one is a processor you need a contract with. If the agent identifies callers by their voice, that is biometric processing and raises the Article 9 question. A vendor’s SOC 2 report speaks to its security controls but does not replace the Article 28 contract. Call recording rules in individual countries are a separate layer; see call recording consent. For an infrastructure view, read the guide on on-premise voice AI.

Questions to ask counsel

1. Which lawful basis fits recording and transcribing calls in our use case?
2. Are we controller, processor, or both, and who are our processors and sub-processors?
3. Do any steps move audio or transcripts outside the EU, and what transfer mechanism covers them?
4. Does speaker identification or voice verification count as biometric processing for us?
5. Do any of our agent’s decisions have legal or similarly significant effects that trigger Article 22?

Related terms

• Data retention
• Zero data retention
• HIPAA
• SOC 2

Guides

• On-premise voice AI: what it is and how it works

Sources

• Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex