Answer

Can we use AI automation and still comply with GDPR?

Yes. GDPR does not ban AI; it requires a lawful basis, a data processing agreement with every processor, transparency towards the person, and data minimisation. In practice that means a signed agreement, a line in your privacy notice, masking fields the automation does not need, and a defined retention period for transcripts and logs.

Last updated: 22 September 2026

The four things to put in place

None of these is unusual; they are the same obligations you already have for your accounting software or your email provider. The difference is that AI processing is newer, so it is worth writing down explicitly rather than assuming it is covered.

01A data processing agreement covering the AI processing
02A sentence in your privacy notice describing the processing
03A record in your processing register with purpose and retention
04A retention rule for call recordings, transcripts and logs

Calls and recordings need one extra step

If conversations are recorded, callers must be told at the start of the call, with the purpose and the retention period. Many deployments avoid the issue entirely by keeping only the structured result, the booking, the question and the outcome, and discarding the audio.

Special categories stay out

Health data, biometrics and similar special categories need a stronger legal basis and are usually excluded from the automation's scope altogether. A dental practice can automate booking and reminders without the assistant ever touching a medical record.

Asked next

Do we need a data protection impact assessment?

Usually not for standard SME automations like booking or invoice capture. It becomes relevant with large-scale profiling or special category data, and we flag it at scoping.

Can a customer ask what the AI knows about them?

Yes, and the answer is a normal subject access request. Because every interaction is logged against the customer record, producing that export is a query rather than a manual search.