Skip to main content
Audact
See the offer

GDPR

GDPR for voice and chat AI: the duties, and who carries them.

In force since 25 May 2018

Last reviewed: 8 October 2026

The GDPR applies to any organisation processing personal data about people in the EU, whoever built the AI. For a voice or chat agent it comes down to four things: a lawful basis for every processing activity, a limit on what the system may settle on its own, information given at the moment of collection, and the ability to erase a person on request. Audact runs as a processor; the customer stays the controller throughout.

What the law requires

Every processing activity (collection, inference, storage) needs its own lawful basis, and that basis has to be settled before the processing starts.
Regulation (EU) 2016/679, Art. 6(1)
A voice recording, or content revealing health, beliefs or sexual orientation, can be special-category data. That needs a stronger basis, such as explicit consent.
Regulation (EU) 2016/679, Art. 9(1) and 9(2)(a)
A person has the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where such a decision is allowed, the controller must offer human intervention, the right to express a view and the right to contest it.
Regulation (EU) 2016/679, Art. 22(1) and 22(3)
Information must be given at the point of collection: who the controller is, the purposes, the legal basis, the retention period, and whether automated decision-making is involved.
Regulation (EU) 2016/679, Art. 13 and 14
A data protection impact assessment is required where processing is likely to result in a high risk, which systematic monitoring using a new technology usually is.
Regulation (EU) 2016/679, Art. 35(1) and 35(3)
A transfer outside the EEA needs a Chapter V instrument: an adequacy decision, or standard contractual clauses supported by an assessment of the destination country.
Regulation (EU) 2016/679, Art. 44-46 · CJEU C-311/18 (Schrems II)
The upper fine tier is €20 million or 4% of worldwide annual turnover, whichever is higher. Note the direction: under the AI Act the cap for SMEs runs the other way.
Regulation (EU) 2016/679, Art. 83(5)

What Audact does about it

Primary application hosting is Frankfurt (AWS eu-central-1). Where a sub-processor is US-owned, the transfer runs under standard contractual clauses and the sub-processor list names it.
Working today
A backup region in Ireland (eu-west-1) is being set up.
In development
Audio is not retained by default. Where a customer switches recording on it is kept for up to 90 days and then deleted; compliance metadata and hashes are kept for the agreed retention window.
Working today
Erasure destroys the key that decrypts the payload, so the sequence remains checkable while the content is gone.
In development
Each interaction carries the lawful basis it was placed under, so a later access or objection request can be answered from the record rather than from memory.
In development

Roles

Audact is the processor. You remain the controller.

Audact processes personal data on the documented instructions of the customer and for no other purpose. That makes the customer the controller: the party that decides why and how data is processed, and the party a data subject or a supervisory authority addresses first.

The standard data processing agreement sets out the sub-processors, the retention windows and the assistance we owe on access, rectification, erasure and portability requests. Enterprise customers can request a bespoke agreement.

Article 22

The provision that decides what your agent may settle on its own.

Article 22 is the most consequential GDPR provision for an AI deployer, and it is not about disclosure at all. It constrains the decision itself: an agent that declines an application, refuses a booking, triggers a fraud block or fixes a price without a human looking at the substance sits squarely inside it.

The Court of Justice held in SCHUFA (C-634/21) that a probability score produced by one party and relied on by another to drive the decision is itself automated decision-making. For a vendor supplying scoring or eligibility logic that reading widens the exposure considerably: the decision does not have to be yours for Article 22 to reach the score you produced.

Transfers

Chapter V is a question about sub-processors, not about your call.

A voice AI stack is assembled from components, and the transfer question follows each component rather than the product name on the invoice. The honest answer for Audact is that primary application hosting is Frankfurt, and that a small number of sub-processors are US-owned and process under standard contractual clauses. The sub-processor list names each one, so a transfer impact assessment can be written against facts instead of assurances.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

Does Audact store what was said on the call?
Audio is not retained by default. Where a customer switches recording on it is kept for up to 90 days and then deleted. Compliance metadata and cryptographic hashes are retained for the agreed window. Those are what a receipt is made of.
Is Audact a controller or a processor?
A processor. The customer stays the controller and Audact processes only on the controller's documented instructions, under the standard data processing agreement.
How does erasure work if the evidence chain has to keep verifying?
Crypto-shredding is coming soon: the key that decrypts the payload will then be destroyed, which makes the personal data unreadable. Cryptographic hashes are not destroyed; depending on linkability and auxiliary information, they can still be personal data where they are linkable. The chain still recomputes and a later alteration or reordering is still detectable.
Does GDPR consent also cover the ePrivacy opt-in?
No. ePrivacy is lex specialis for the act of sending an electronic communication and needs its own prior opt-in. The two are assessed separately, and a consent captured for one does not carry to the other.

See what a receipt actually contains

Three fields on every receipt can be recomputed by anyone today: the input hash, the output hash and the link to the previous receipt. No key, no account. Merkle inclusion is the fourth, and it is checked against the published root with the inclusion proof from the call's Article 50 report. Proof walks through a real one, field by field.

See a receipt

Related