Is it legal to have an AI answer your business calls in the UK?
Yes: in the UK a business can use an AI to answer its calls, as long as it handles callers’ personal data in line with UK GDPR and is open with callers about what is happening. In practice that means saying it is an AI, explaining how their information is used, having a data processing agreement with the provider and knowing where the data is stored.
The rules that apply
This is general information, not legal advice. For your own situation, speak to a solicitor or check the ICO’s guidance.
UK GDPR and the Data Protection Act 2018
Callers’ names, numbers and what they tell you are personal data. You need a lawful basis to use them, should keep only what you need and must keep it secure. The regulator is the Information Commissioner’s Office (ICO).
Being open with callers
People should know who is handling their information and why. Saying at the start that they are speaking to an AI, and pointing to your privacy notice, is a clear way to do that.
A contract with your provider
When a supplier handles personal data for you, Article 28 of UK GDPR requires a written contract setting out what it may do with it: a data processing agreement, or DPA.
Where the data is stored
UK data protection law allows personal data to be transferred to the EEA. For other countries extra safeguards may be needed, so ask any provider where your data is kept.
Customers in the EU
The EU AI Act requires that people are told they are interacting with an AI system, unless it is obvious (Article 50). These transparency rules are due to apply from 2 August 2026, although the European Commission has proposed changing some of the Act’s dates.
Spain
If you also serve customers in Spain, our Spanish guide covers the RGPD, the LOPDGDD and the AI Act.
Transcripts and recordings
A transcript is personal data too
Whether a call is recorded or transcribed, what the caller says is personal data. Keep it for as long as you need it, and no longer.
Recording means telling callers
Recording the voice means keeping more data, and callers should be told. A service that only transcribes keeps less.
A short checklist
| What we compare | What to check | How Zatio handles it |
|---|---|---|
| AI disclosure | The assistant says it is an AI | It says so at the start of every conversation |
| Privacy notice | Your notice mentions calls, WhatsApp and chat handled by an AI provider | Your notice is yours; Zatio’s privacy policy explains its part |
| DPA | A data processing agreement with the provider | Every customer has a DPA as part of our terms; a signed copy if you need one |
| Where data is stored | In the UK or EEA, or with safeguards | In the European Union (Stockholm) |
| Recordings | Recorded or transcribed | Calls are transcribed, not recorded |
| Security | Encryption and separation of data | TLS 1.2+ in transit, AES-256 at rest and each customer’s data isolated |
| Reaching a person | Callers can get to your team | Transfers the call to your team or takes the caller’s details for a call back |
How Zatio does it
Says it is an AI
At the start of every conversation, on the phone, WhatsApp or website chat. It does not pretend to be a person.
EU data, no recordings
Data stored in the European Union (Stockholm). Calls are transcribed, not recorded, and every customer has a DPA.
Price
From £69 a month excluding VAT, with 400 voice minutes, plus WhatsApp and website chat.
Questions
Do I have to tell callers they are speaking to an AI?
Telling them is the clearest way to be open about how their information is handled. For customers in the EU, Article 50 of the EU AI Act requires that people are told they are interacting with an AI, unless it is obvious, with these rules due to apply from 2 August 2026. Zatio says it is an AI at the start of every conversation.
Does Zatio record calls?
No. Calls are transcribed, not recorded. A transcript is still personal data, so it gets the same care as any other customer record.
Do I need a data processing agreement?
Yes: when a supplier handles personal data for you, Article 28 of UK GDPR requires a contract. Every Zatio customer has a DPA as part of our terms, and we’ll send a signed copy if you need one.
Can a UK business keep customer data in the EU?
Yes. UK data protection law allows personal data to be transferred to the EEA. Zatio stores data in the EU (Stockholm), with TLS 1.2+ in transit and AES-256 at rest.
Is this legal advice?
No. This guide is general information as of 15 October 2026. For your own situation, speak to a solicitor or check the ICO’s guidance.
Zatio in your industry
How Zatio works in each industry: what it asks, what it books and what it passes to your team.
Hear how Zatio introduces itself
Leave your mobile and Zatio rings you within seconds.
- Keep your number
- No annual commitment
- 60-day guarantee
Rather talk to a person? Book a 20-minute demo.