Why this matters for voice AI
An AI voice agent processes personal data on every call: the caller's voice, phone number, name, the reason for calling and often an address or booking reference. In the UK this falls under the UK GDPR and the Data Protection Act 2018. In the UAE it falls under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The principles are similar, and a well-run setup can meet both.
This article is general guidance, not legal advice. Speak to your own adviser about your circumstances.
Who is responsible
When a business uses an AI voice agent on its phone line, the business is usually the controller: it decides why and how caller data is used. The voice AI provider is usually a processor, acting on the business's instructions. The two should have a written data processing agreement that sets out instructions, security, subprocessors, breach notification and deletion.
Tell callers what is happening
Transparency is central to both laws. Callers should know:
- That they are speaking with an AI assistant.
- Whether the call is transcribed or recorded, and why.
- Who is responsible for their data and how to contact them.
- Where to find the full privacy notice.
A short, friendly greeting can cover the first two points, with the rest in your published privacy policy.
Choose a lawful basis
Under the UK GDPR, handling a caller's request usually relies on the performance of a contract or on legitimate interests. Under the UAE PDPL, consent and contract performance are the most common grounds. Whatever the basis, document it and make sure it matches what you actually do with the data.
Collect less
Configure your assistant to ask only for what it needs to resolve the call. Avoid collecting health information, payment card numbers or other sensitive data over the phone unless your setup is specifically designed and approved for it.
Know where data goes
Ask your provider:
- Which subprocessors handle call audio and transcripts, and where they are located.
- What safeguards cover international transfers, such as the UK International Data Transfer Agreement.
- Whether call data is used to train AI models.
- How long transcripts and call details are kept, and how deletion works.
Keep humans in the loop
Both laws give people protection from significant decisions made purely by automated means. Keep consequential actions, such as spending money, refusing a service or dispatching contractors, subject to human review.
Be ready for requests
People can ask to access, correct or delete their data. Make sure you can find a caller's transcripts and details quickly, and that your provider will help you respond.
How Clodia handles it
Clodia acts as processor for its business customers under written data protection terms, lists its subprocessors publicly, does not use call data to train third-party models, and keeps consequential actions behind human approval. Read our privacy policy for the detail.
Sources and further reading
- ICO: UK GDPR guidance and resources
- legislation.gov.uk: Data Protection Act 2018
- UAE Government portal: data protection laws
Hear Clodia for yourself.
Try a live conversation in your browser, or tell us about your front desk.