Guide · GDPR Phone Answering (UK & EU)
GDPR-compliant phone answering means documenting lawful basis for processing, minimizing data collected on calls, honoring opt-outs for SMS, using subprocessors with appropriate safeguards, and giving patients clear notice about recording and automated handling.
Pick a lawful basis before you flip the switch
Appointment booking often relies on contract or legitimate interests, but marketing SMS and call recording may need explicit consent depending on jurisdiction and practice type. Document the choice per workflow.
Vendor due diligence checklist
- Data Processing Agreement with your AI vendor
- Subprocessor list with EU/UK transfer mechanisms
- Retention limits on transcripts and recordings
- Right-to-erasure workflow for patient requests