An AI voice agent can answer calls and manage appointments by processing data such as a phone number, a name or the details of a booking. Not every solution records conversations, but even when no audio is kept, personal data may still be processed. To know whether a system complies with the rules, you need to review what it processes, what it stores, why and for how long.
Note: This article is general information for businesses in Spain and the European Union. It is not legal advice and does not certify compliance for any specific deployment.
What data can a voice agent process during a call?
Someone calls to change an appointment. They give their name, say the day of the booking and provide a contact number. To carry out that task, the assistant may need to interpret the request, find the appointment and update the calendar.
All of this raises concrete questions. Which systems does the information reach? What is finally stored? Who can see it? When is it deleted?
The General Data Protection Regulation (GDPR), in Article 4, treats as personal data any information relating to an identified or identifiable person. It is not limited to names and surnames: a combination of phone number, appointment and notes can identify someone.
Depending on the solution and its configuration, these elements could be involved during a call:
| Information | What it could be used for | Does it have to be kept? |
|---|---|---|
| Phone number | Identifying or returning a call | Depends on the purpose and configuration |
| Name | Finding or recording an appointment | Only when necessary |
| Date, time and service | Creating or changing a booking | May be needed in the calendar |
| Real-time audio | Interpreting what the person says | Does not imply keeping a recording |
| Transcript or summary | Following up a request | Should not be kept by default without a defined purpose |
| Technical logs | Diagnosing errors or running the service | Review content, access and retention period |
The table does not describe the data actually stored by every provider or by S.A.R.A.; it shows categories to investigate.
The right criterion is not to keep everything in case it is useful one day. Article 5 of the GDPR requires data to be limited to what is necessary for specified purposes and not kept indefinitely. This is known as data minimisation and storage limitation.
Does processing audio mean recording and keeping the call?
No. They are different actions, although they are often confused.
A conversational assistant needs to process the voice to interpret words and respond. That processing can happen during the communication without the business keeping an audio file afterwards. However, not recording the audio does not by itself prove that there are no transcripts, summaries, event logs or calendar data.
That is why it helps to distinguish at least three operations:
- Processing: the information is used to keep the conversation going and carry out the task.
- Recording: the conversation is captured in a file that can be played back later.
- Retention: a system keeps audio, text, metadata or logs for a period.
A business must know the complete path of the data, including any external services involved in the call. It is also worth checking whether any of them keeps information for diagnostics, security or improving its products, and whether those uses are permitted and documented.
Is consent required for every call? There is no universal rule. Article 6 of the GDPR provides for different legal bases, and the right one depends on the purpose and the circumstances. Recording for a purpose different from what is needed to book an appointment requires a specific assessment; do not assume the same legal basis works for any later use.
As a result, "we do not record calls" is a technical feature that must be verified, not an automatic guarantee of legal compliance.
What does the GDPR require to manage appointments with an AI?
The GDPR does not prohibit a business from using a phone assistant. What it requires is that the processing of personal data has a basis and adequate safeguards. In Spain, Organic Law 3/2018 (LOPDGDD) (in Spanish) also applies.
To assess a booking agent, review these questions:
Purpose and legal basis. What data does it need to give information, book or change an appointment? What is the legal basis for each processing activity? A booking request and a recording for training purposes may require different analysis.
Transparent information. Article 13 of the GDPR sets out the information that must be provided when data is obtained from the person: identity of the controller, purpose, legal basis, recipients, retention period and rights, among other things. The Spanish Data Protection Agency (AEPD) (in Spanish) recommends presenting it in layers: basic information when the data is collected and easy access to the detail.
Who decides and who provides the service. The business and its providers may play different roles. When a provider processes data on behalf of the controller, Article 28 of the GDPR requires an agreement governing the processing, including subcontracted services where applicable.
Security. Article 32 requires measures proportionate to the risk, such as access controls, system protection and review of technical and organisational measures. No marketing phrase replaces that check.
Retention, rights and transfers. You need to establish how long each piece of data is needed, how it is deleted, how people's rights are handled and whether there are international transfers with the required safeguards.
Do you have to tell people that an artificial intelligence is answering?
Article 50.1 of Regulation (EU) 2024/1689 on Artificial Intelligence provides that systems intended to interact directly with people must be designed to inform them of that interaction, subject to the exceptions it sets out. The information must be clear and given in the terms of the regulation. You should review its consolidated text and how it applies to the specific case before deployment.
Presenting the agent as an automated assistant from the start prevents the caller from thinking they are talking to a person. But informing people that it is an AI and meeting the GDPR information duty are different obligations: a short introduction does not by itself replace all the privacy information.
What if the call includes health information?
Not all calendars contain the same kind of information. An appointment at a hair salon does not necessarily pose the same risks as one at a clinic.
In a healthcare setting, a person might spontaneously describe symptoms, treatments or diagnoses. Data concerning health is a special category regulated by Article 9 of the GDPR, so processing it needs an additional condition and adequate safeguards.
That is why a solution for healthcare appointments should clearly define which questions it can ask and what information it really needs. If recording the service, the time slot and a contact is enough, there is no operational reason to ask for a full medical history.
It is also important to distinguish managing an appointment from giving medical advice. A calendar assistant should not improvise diagnoses or clinical answers outside its function. When a request goes beyond what was planned, there must be a clear procedure to pass it to professionals or to a suitable channel.
The analysis must be adapted to each activity. It is not correct to label any phone agent as safe for clinics simply because it works well in another kind of business.
How have we approached it at meiika?
At meiika we design custom systems. One of our demonstration cases is S.A.R.A. — Sistema de Atención, Reservas y Agenda, a voice assistant for businesses that work by appointment.
S.A.R.A. introduces itself at the start of the call as an automated assistant, gives information about services and opening hours, checks the calendar, manages bookings, changes or cancellations, and can leave a note for the team when it cannot resolve a request. Before saving operations, it confirms the relevant details.
In this demonstration we do not record the audio of calls: audio recording is switched off in the configuration. But that does not mean there is no data: the platform that orchestrates the call may keep logs or transcripts depending on its configuration, and the information about an appointment is stored in a database located in the European Union. We are reviewing contracts and retention periods with each provider, and the demo you can listen to is a recording with fictitious data.
We do not claim, therefore, that no data is processed at all, that all records are deleted immediately or that S.A.R.A. holds any compliance certification. These are different matters that require checking the infrastructure and the corresponding contracts, which is exactly what we are reviewing before offering it to a real business.
You can listen to the S.A.R.A. demo and read the privacy policy of meiika.es, which explains how we handle data from the website and from the demonstration. S.A.R.A. is a demonstration case, not a product to which we attribute clients or results that we have not proven.
What should you check before hiring an agent?
Before putting an assistant into production, we recommend asking for concrete answers about how it works. It is not enough for someone to say that the solution "complies with the GDPR".
- Data map: what information each provider receives and where it is stored.
- Audio and text: whether a recording, a transcript, a summary or technical logs are kept.
- Periods: how long each category is kept and how it is deleted.
- Contracts: who is the controller, who acts as processor and which sub-processors are involved.
- Access: who can see conversations, calendars and logs.
- Incidents: what happens if the AI misinterprets a request or an integration fails.
- Privacy: how the caller is informed and how they can exercise their rights.
- Sensitive data: what additional limits apply if the service handles clinics or other sensitive sectors.
The aim is not to pile up documents: it is to be able to explain precisely what happens from the moment a call comes in until the appointment is managed and the data is no longer needed.