Get started

Choosing a GDPR-compliant AI phone agent

This guide is general information, not legal advice. GDPR obligations depend on your specific role, data flows, jurisdictions, and configuration. Consult qualified counsel before deploying an AI phone agent that handles personal data of people in the EU or EEA.

If your business answers or places calls involving people in the EU, an AI phone agent is a data-protection decision as much as a product decision. Every call creates personal data, and the platform you choose becomes part of your GDPR compliance story. This guide explains why voice AI falls under the GDPR, what to look for in a platform, ThunderPhone's stated posture, and how three other widely evaluated platforms publicly describe theirs.

Why an AI phone agent is personal-data processing under GDPR

The GDPR governs processing of personal data — any information relating to an identifiable person. An AI phone agent touches several categories of it on virtually every call:

  • Voice recordings. A recording of an identifiable caller's voice is personal data: a voice can identify a person, and a recording also captures names, contact details, and whatever the caller discusses. If voice characteristics were used to uniquely identify someone, biometric-data rules under Article 9 could additionally apply — most deployments do not do this, but the recording remains personal data regardless.
  • Transcripts. Speech-to-text output preserves the conversation in searchable form. Anything the caller says — health details, financial circumstances, complaints — lands in the transcript. Where callers can discuss special-category data (health is the common example for clinics and insurers), the compliance bar rises.
  • Caller metadata. Phone numbers, timestamps, durations, outcomes, grading labels, and any CRM fields the agent reads or writes are personal data when they relate to an identifiable caller.

GDPR also assigns roles, and they determine who owes what:

  • You (the deploying business) are typically the controller. You decide why calls are handled, what the agent asks, what is recorded, and how long data is kept.
  • The platform is typically a processor, handling call data on your instructions. Article 28 requires a data processing agreement (DPA) with mandatory terms — confidentiality, security measures, sub-processor rules, assistance with data-subject rights, and deletion or return of data at the end of the relationship.

Two consequences follow. First, a platform's compliance statements never discharge your controller obligations: lawful basis, caller notices, retention, and data-subject requests remain yours. Second, you cannot lawfully use a processor that will not commit to Article 28 terms — a vendor's paperwork is a real evaluation criterion, not a formality.

International transfers add one more layer. If call data leaves the EU/EEA — for example, to U.S. servers — Chapter V requires a valid transfer mechanism, most commonly standard contractual clauses (SCCs) or an adequacy framework.

What to look for in a platform (generic checklist)

These criteria apply to any AI phone agent platform:

  1. A signable DPA. The baseline. Check whether the vendor publishes its DPA, whether it can be executed self-serve, and whether it lists sub-processors. Voice AI platforms often chain several (speech recognition, language models, speech synthesis, telephony), and each is part of your processing chain.
  2. Disclosure and consent support. Many EU member states layer call-recording rules on top of GDPR, and emerging AI rules add expectations that callers know they are talking to a machine. Practically, you need to control what the agent says at the start of a call — a configurable disclosure or greeting — and how it behaves if a caller objects.
  3. Data-subject-request handling. Under Articles 15–17, callers can ask you for access, correction, or erasure. You answer the request as controller, but the platform must make it feasible: can you find all calls from a given number, export the recording and transcript, and delete them? Check what the processor's required assistance looks like in the product, not just the contract.
  4. Retention controls. Storage limitation (Article 5(1)(e)) means a defensible answer to "how long do recordings and transcripts live, and why?" Ask what the default retention is, whether you can shorten it, and whether recording can be disabled for flows that do not need it.
  5. Security measures. Article 32 requires appropriate technical and organizational measures: encryption in transit and at rest, access controls, and authenticated integrations (for example, signed webhooks so call data cannot be spoofed into your systems).
  6. Data residency and transfer posture. Where are calls processed and stored? If outside the EU, which transfer mechanism applies? Some platforms offer EU residency only on certain plans — a detail that can change your total cost.

ThunderPhone's posture

ThunderPhone's public compliance posture is that the platform is GDPR and HIPAA compliant. Customers remain responsible for configuring their workflows, data handling, recordings, integrations, and notices for their own obligations — a division of responsibility that parallels the controller/processor split described above: the deploying business still owns lawful basis, disclosure, and retention decisions for its use case.

Several documented capabilities are relevant to the checklist:

  • Customer-controlled prompts for disclosure wording. Agents run on prompts the customer writes and controls, so recording notices and "you are speaking with an AI assistant" wording can be built into the agent's opening behavior — and it is the customer's responsibility to configure and verify that wording where required.
  • Testing tooling to verify the configured behavior. Browser mic tests, AI-caller simulations, reusable scenarios, graded call logs, and regression suites with minimum pass-rate gates let you verify that a disclosure is actually spoken and that objections are handled as configured — before and after every change. Simulations are billable real calls; the interface shows the charge before a run.
  • Authenticated data delivery. Webhook delivery supports multiple endpoints with per-endpoint secrets, event subscriptions, and HMAC-SHA256 request signatures, so call data flowing into your systems is integrity-checked rather than accepted on faith.
  • Scoped knowledge bases. Documents are attached per agent rather than applying automatically, which supports data-minimization by design: an agent only searches the material you explicitly scoped to it.
  • Controlled web-widget deployment. The embeddable voice widget uses domain allowlists and origin-locked publishable keys, and widget sessions produce the same transcript, recording, and grading records as phone calls — so browser conversations sit in the same records you manage for data-subject requests.

As with any platform, an EU-serving buyer should confirm current DPA terms, sub-processor list, retention defaults, and data-residency details directly with ThunderPhone before going live.

How other platforms publicly describe GDPR

They are summaries of published positioning, not compliance determinations; vendors legitimately differ in architecture and market focus.

  • Retell AI states GDPR compliance via its infrastructure with a GDPR-compliant data processing addendum incorporating EU standard contractual clauses, and its DPA is self-signable through a click-agreement portal. The same compliance page notes that Retell does "not currently operate services within the European Union" — a nuance EU buyers should weigh when assessing transfers. Source: Retell compliance docs, accessed 2026-08-18.
  • Vapi's homepage and pricing pages state SOC 2, HIPAA, and PCI compliance; a GDPR claim was not established from the reviewed public sources. Buyers with EU requirements should ask the vendor directly rather than assume either way. Sources: Vapi homepage and Vapi pricing, accessed 2026-08-18.
  • Bland AI's trust page describes GDPR compliance as self-attested, with a DPA and EU data residency "available, configurable per customer"; per its pricing page, data residency is available on the Enterprise plan only. Sources: Bland trust and security page and Bland pricing, accessed 2026-08-18.

The pattern worth noticing: "GDPR" on a vendor page can mean self-attestation, a DPA plus SCCs from non-EU infrastructure, or residency options gated to certain plans. The label alone does not tell you which — the underlying documents do.

Evaluation checklist for EU-serving buyers

Before signing with any platform:

  1. Map the data flow. List every place a call's audio, transcript, and metadata travels: platform, speech and model sub-processors, telephony carrier, CRM, webhook consumers.
  2. Get the DPA and sub-processor list in writing. Confirm Article 28 terms and how sub-processor changes are notified.
  3. Pin down data location and transfer mechanism. EU processing, or non-EU processing under SCCs? If residency matters, confirm which plan tier includes it and price that tier.
  4. Configure and test disclosure. Draft recording/AI-disclosure wording with counsel, put it in the agent's greeting, and use the platform's testing tools to verify it is spoken on every relevant flow, including transfers and voicemail.
  5. Decide retention before launch. Set how long recordings and transcripts are kept, confirm the platform honors it, and document the justification.
  6. Rehearse a data-subject request. Run a drill before go-live: find all data for one test caller's number, export it, delete it. Time it against GDPR's one-month response window.
  7. Check integration security. Prefer signed webhooks (e.g., HMAC-SHA256) and scoped credentials for anything moving call data into your stack. 8.** Public pages change; the DPA you sign and the configuration you deploy are what count.

FAQ

Does GDPR apply if my company is outside the EU?

It can. GDPR's territorial scope (Article 3) covers processing related to offering goods or services to people in the EU or monitoring their behavior there, wherever your company sits. If your agent answers calls from EU customers as part of serving them, assume GDPR is in scope and confirm with counsel.

Is an AI phone call recording really "personal data"?

Yes. A voice recording of an identifiable caller is personal data, as are the transcript and call metadata. Special-category rules can additionally apply when calls foreseeably involve health or other Article 9 data — common in medical, insurance, and legal use cases.

Who is responsible for GDPR compliance — my business or the platform?

Both, in different roles. The deploying business is typically the controller (lawful basis, notices, retention, data-subject requests) and the platform a processor bound by a DPA to process only on instructions and assist the controller. A platform's posture supports, but never replaces, the controller's own obligations — which is why ThunderPhone pairs "GDPR and HIPAA compliant" with explicit customer responsibility for configuring workflows, recordings, and notices.

Do callers have to consent to talking to an AI agent?

Not necessarily under GDPR alone, but disclosure rules are layering in. GDPR offers several lawful bases besides consent, but transparency obligations, member-state call-recording rules, and emerging AI regulations increasingly expect callers to be told they are speaking with an AI system. Practically: the platform must let you control the disclosure wording, and counsel must confirm what your jurisdictions require.

Which AI phone agent platforms say they are GDPR compliant?

Public statements differ in kind. ThunderPhone's public posture is GDPR and HIPAA compliant, with customer responsibility for configuration. Retell states GDPR compliance via its infrastructure with a self-signable DPA and EU SCCs, while noting it does not currently operate services within the EU. Bland describes GDPR as self-attested with a DPA and enterprise-tier configurable EU data residency. A GDPR statement was not established from Vapi's reviewed public pages. All statements accessed 2026-08-18; verify current wording with each vendor.

What should I ask a vendor before signing?

Six things: a signable DPA with the current sub-processor list; where call data is processed and under what transfer mechanism; default and configurable retention; how you would fulfill an access or erasure request end to end; how disclosure wording is configured and tested; and which capabilities are gated to specific plan tiers.

Sources and freshness

ThunderPhone statements reflect its published pricing and documentation as of August 19, 2026; third-party statements come only from the official vendor pages linked next to each claim, on the accessed dates shown. This guide is documentation-based — no vendor account, DPA text, or live deployment was tested — and its regulatory summaries are simplified general information, not legal advice. Vendors change their pages often, so confirm against the live vendor pages before relying on them.