AI assistants and the GDPR: What has to be in place?

For companies in Germany, an AI assistant is compatible with the GDPR if six things are in place: a legal basis under Art. 6(1) GDPR, a data processing agreement under Art. 28 with every provider, a transfer basis for US services, privacy information under Art. 13, retention periods under Art. 5(1)(e) and, for phone calls, consent before any recording.

Business owners ask the questions below before launching an assistant. Each answer cites the provision so you can check it with your data protection officer.

On what legal basis may the assistant process data?

If the assistant answers an inquiry, books an appointment or takes an order, the legal basis is Art. 6(1)(b) GDPR: processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract. The caller wants something from you, and the assistant delivers it.

Anything beyond that falls under Art. 6(1)(f) GDPR, legitimate interest: the assistant recognizes repeat callers, sorts requests by urgency or stores samples for quality control. For this you write down the balancing test explaining why your interest does not override that of the person. You only need consent under point (a) if you use the calls for something unrelated to the request, such as training a model or advertising. We advise against it, because a withdrawal of consent is hard to implement cleanly in ongoing operation.

Do I need a data processing agreement with every provider?

Yes. The provider that runs the assistant for you processes data on your behalf. Art. 28(3) GDPR requires a contract for this that sets out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects, and contains the obligations in points (a) to (h): processing only on instructions, confidentiality, security measures under Art. 32, conditions for engaging further processors, assistance with data subject rights, deletion at the end, evidence and audits.

Behind the assistant there are almost always further services: language model, speech recognition, speech synthesis, telephony. These are sub-processors. The provider must name them to you and bind them to the same obligations, Art. 28(2) and (4). You check whether every service is listed with its location and whether the contract excludes the use of your data for training. If either is missing, the contract is not ready to sign.

May the assistant use a US provider?

Yes, under conditions. Under Art. 44 GDPR, every transfer to a third country needs a basis from Chapter V. For the US, that is the adequacy decision on the EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795 under Art. 45(1) GDPR. It applies to companies that have certified with the US Department of Commerce. The major model providers are certified. You can check this in the framework's public list.

The decision is under pressure. The EU General Court dismissed the action against it on September 3, 2025 (T-553/23, Latombe). The appeal is pending before the Court of Justice as C-703/25 P, and as of September 2026 there is no judgment. In addition, the US Supreme Court ruling of June 29, 2026 (Trump v. Slaughter) weakens the independence of the US Federal Trade Commission (FTC), on which the decision relies. Whether the Commission will amend the decision as a result is open.

Our recommendation: processing in an EU region of the provider, standard contractual clauses under Art. 46(2)(c) GDPR in the contract as a second basis, and a short transfer impact assessment. If the decision falls, you update one document and keep working. Without this precaution, the assistant stops on the day of the ruling.

What must customers be told before the assistant talks to them?

Art. 13(1) and (2) GDPR requires information at the time of collection: who the controller is, for what purpose and on what basis data is processed, which recipients receive the data, whether it goes to a third country, how long it is stored and what rights the person has. For a chatbot, this belongs in the privacy policy with a link directly in the chat window. On the phone, one sentence referring to the policy on the website is enough. Since August 2, 2026, Art. 50 of the EU AI Act (Regulation (EU) 2024/1689) adds that the person must be told they are speaking with an AI. Both belong in the same greeting.

How long may the assistant store calls and inquiries?

As long as the purpose requires, Art. 5(1)(e) GDPR. After that, the obligation to erase under Art. 17(1)(a) applies. Under Art. 13(2)(a), the storage period has to be stated in the privacy policy, so you need concrete periods. A proven approach: audio recordings are deleted after transcription, at the latest after 30 days. Logs are tied to the case and go with it. If the call turns into an order or business correspondence, the six-year period under Section 257(4) of the German Commercial Code (HGB) applies to the case, not to the audio recording. You set the periods in the system, not in an instruction to staff. Only that way can you demonstrate under Art. 5(2) that data is deleted.

When is a data protection impact assessment mandatory?

Art. 35(1) GDPR requires one when processing, in particular using new technologies, is likely to result in a high risk to the rights of data subjects. Under paragraph 4, the supervisory authorities publish lists of processing operations for which this always applies. The mandatory list of the German supervisory authorities names, under item 11, processing that uses artificial intelligence to control an interaction with the data subject. A chatbot or phone assistant controls an interaction. That makes the impact assessment mandatory for most deployments.

It is less work than it sounds. For an assistant that answers inquiries and books appointments, the DPIA describes the processing, the risks (incorrect information, misrouting, access by third parties, third-country transfer) and the measures against them. One to two working days, if the provider supplies the technical details. The guidance of the German Data Protection Conference (DSK) on AI and data protection of May 6, 2024 provides the structure.

May the phone assistant record calls?

Only with the consent of everyone involved. Section 201(1) no. 1 of the German Criminal Code (StGB) punishes anyone who records another person's privately spoken words on a sound carrier without authorization with imprisonment of up to three years. A phone call is private, and a recording on the provider's server is a recording, even if it only sits there briefly for transcription.

The recording is authorized with consent. That is why the first thing the assistant says is that it is an AI assistant, that the call is being recorded and that the caller can ask for an employee at any time. Anyone who keeps talking after that consents. This sentence is the difference between lawful operation and a criminal offense, and it has to be said in every call, including callbacks the assistant initiates itself.

What applies to medical practices and health data?

If a caller to a practice states the reason for the appointment, the assistant processes health data. Under Art. 9(1) GDPR, such data is prohibited in principle. Processing is permitted under Art. 9(2)(h) for health care and its administration, but only under paragraph 3: by professionals subject to professional secrecy or by another person subject to an obligation of secrecy. The assistant provider is such another person. The contract with it must therefore contain an explicit confidentiality obligation.

Section 203(3) and (4) of the German Criminal Code (StGB) requires the same: doctors may involve other contributing persons, but must bind them to confidentiality, or they become criminally liable themselves. For practices we recommend three fixed rules: processing only in the EU, no US model provider on the voice channel, and a DPIA in every case, because Art. 35(3)(b) GDPR explicitly names large-scale processing of health data. An appointment assistant that only takes the name, preferred time and callback number and does not ask about the complaint processes hardly any health data. That is often the better design.

Checklist before launch

1. Legal basis set for each function: point (b) for inquiries and appointments, point (f) with a documented balancing test for everything else
2. Data processing agreement under Art. 28(3) GDPR signed, list of sub-processors with locations complete
3. Use of your data for training excluded in the contract
4. Processing in an EU region, standard contractual clauses as a second basis, transfer impact assessment on file
5. Privacy policy under Art. 13 GDPR updated, link in the chat window, reference in the phone greeting
6. Greeting includes: AI assistant, recording, option to switch to an employee
7. Retention periods set in the system: audio recordings, logs, cases
8. Data protection impact assessment under Art. 35 GDPR carried out and on file
9. Entry in the record of processing activities under Art. 30 GDPR
10. For health data: provider's confidentiality obligation under Section 203 StGB in the contract, no US provider on the voice channel

How we do it at B&S

B&S Ventures from Hannover runs systems in its own portfolio companies that process personal data every day, including vendor portals with identity verification and mail systems in several languages. With an AI assistant from B&S, the data processing agreements with every provider involved, the text for your privacy policy and the AI notice in the greeting are part of the delivery. We set retention periods in the system and prepare the impact assessment together with you. What the EU AI Act requires on top of this is covered under What obligations does an SME have under the EU AI Act?

We start with one channel and expand in stages. The intro call and an initial direction are free of charge, followed by a proposal. On request, we review an existing assistant in a booked consulting session.

Frequently asked questions

Do I need visitors' consent for an AI chatbot on my website?

Not for answering a request. The legal basis is Art. 6(1)(b) GDPR when the person wants something from you, otherwise point (f). You only need consent for other purposes, such as training a model or advertising.

Is a data processing agreement with the assistant provider enough, or do I also need one with the model provider?

One agreement under Art. 28(3) GDPR with the provider that runs the assistant for you. That provider binds its sub-processors, meaning the model providers, to the same obligations under Art. 28(4) and names them to you. You check that the list is complete and that training is excluded.

May an AI phone assistant record calls?

Only with the consent of everyone involved. Section 201(1) no. 1 StGB makes the unauthorized recording of privately spoken words a criminal offense. The assistant therefore says at the start that it is an AI and is recording, and offers a transfer to a person. Anyone who keeps talking after that consents.

What happens if the EU-US Data Privacy Framework falls?

Then US providers lose their basis under Art. 45 GDPR. If you have agreed standard contractual clauses under Art. 46(2)(c) GDPR in the data processing agreement as a second basis and have data processed in an EU region, you update the transfer impact assessment and keep working.

Do I have to carry out a data protection impact assessment?

In most cases, yes. The mandatory list of the German supervisory authorities names, under item 11, processing that uses artificial intelligence to control an interaction with the data subject. A chatbot or phone assistant does exactly that. Without health data, the DPIA can be done in one to two days.

How long may call logs be stored?

As long as the purpose requires, Art. 5(1)(e) GDPR. Audio recordings are deleted after transcription, logs together with the case. If the call becomes business correspondence, the six-year period under Section 257(4) HGB applies to the case, not to the audio recording.

Sources: Regulation (EU) 2016/679, Implementing Decision (EU) 2023/1795, Section 201 StGB, Section 203 StGB, Section 257 HGB, EU General Court T-553/23 of September 3, 2025, Court of Justice of the EU C-703/25 P (pending), US Supreme Court Trump v. Slaughter of June 29, 2026, DSK mandatory list version 1.1, DSK guidance of May 6, 2024. Reviewed on September 22, 2026.