Is an AI receptionist GDPR-compliant in Ireland?

Yes. The GDPR doesn't ban AI from answering calls.

It sets conditions.

The main one: you need a lawful reason to handle a caller's details. A "lawful basis", in the wording of the rules. There are six of them to choose from. Which one fits depends on what your business is actually doing on the call.

The myth worth clearing up first: you do not always need consent.

It's the most repeated line online. Get the caller's consent, or you're breaking the law. And it's simply not true.

The GDPR gives you six lawful bases. Consent is one of them. It doesn't rank above the others, and it isn't the default. It's one option among six.

None of that makes consent wrong.

Plenty of businesses use it, and use it well. Especially where they're recording at scale, doing anything with a marketing angle, where separate rules do push you towards consent, or handling sensitive information. If your setup already runs on consent and it's working, there's no reason to tear it up.

For a lot of small businesses, though, there's a simpler fit.

If you're answering your own phone to help the person ringing and run your business, that's a fair and expected reason to handle their details. The basis that often suits this is legitimate interest. It saves you trying to collect proper, withdrawable consent from every single caller, which is hard to do well on a phone line.

It comes with one small task. You note down why your reason is fair, weighed against the caller's privacy. A short "balancing test", kept on file. A page, not a project.

Which basis is right is your call, and it depends on what you're doing. That's the honest answer. Any page that tells you there's one rule for everyone is selling you something.

What doesn't change is this.

The rules are the same whether a person answers the phone or an AI does. Handing the call to an AI doesn't add a new layer of law on top. The duties you already have as a business are the duties that apply. Nothing more exotic than that.

One flag before you settle it. If callers might mention their health, a symptom, a condition, a medication, there's an extra step, and consent can matter more there. That's its own topic, and we cover it further down.

Both of you. But for different things.

Your business is the controller. You're the one in charge of the caller's data, because you decide the calls get answered and what happens to the details.

Conversegy is the processor. We handle that data on your instructions, and only on your instructions.

The GDPR asks the two of us to put that split in writing. A contract called a data processing agreement, or DPA.

This isn't unique to us, or to AI.

You're the controller for any tool that touches your data on your behalf. Your accountant. Your booking software. The people who print your appointment cards. Conversegy is one more processor on that list. The shape is familiar, even if the words are new.

Being your processor means we're fenced in by that contract.

We only use your callers' data to run your service and keep it working properly. We don't sell it, and we don't use it to build profiles or for anything unrelated to answering your calls. And the tools we rely on behind the scenes, for the voice, the calls, your calendar and your records, each sit under their own data agreements with us.

Now the part a lot of providers won't say out loud.

Nobody can sell you compliance in a box.

A good provider can hand you a product built the right way, and a proper contract to go with it. That's real, and it matters. But it can't lift the legal responsibility off you. As the controller, the buck still stops at your desk.

So if a provider tells you their product makes you compliant, full stop, be wary. That's not how the law works. And it's usually a sign they're glossing over the bits that are actually your call.

Health details get extra protection under the GDPR.

A symptom, a condition, a medication, even mentioned in passing, counts as "special category" data.

For that, a lawful basis on its own isn't enough. You need a second condition on top, just for the sensitive part. And for most businesses that means explicit consent, or keeping the detail out of your records in the first place.

This is the part that keeps clinic owners up at night, and fairly so.

The GDPR treats information about your health differently from your name or your number. It sits in a protected group the rules call special category data, alongside things like religion and biometrics. The bar for handling it is higher.

So the sums change.

For ordinary details, you need one lawful basis. For health details, you need two things. That lawful basis, and a second condition on top, specifically for the sensitive part.

The condition most businesses can actually rely on is explicit consent. Clear, specific, spelled-out agreement from the person. Which is hard to get cleanly from someone ringing in a panic about a sore tooth.

So the cleaner route, and the one Conversegy is built around, is simpler.

Don't capture it in the first place.

The job of the phone line is to book the appointment and take a message. Not to build a medical record. So we take what's needed to do that. The name, the callback number, roughly what it's about, and no more. We don't prompt callers for health detail. And if someone volunteers "it's my chest again", that stays as a passing note to you. It doesn't get promoted into a tidy health field in your records.

Two honest caveats.

We can't stop a caller saying what they say. If someone describes a symptom, it may sit in the call recording or the summary for the short time we hold it. Minimising isn't a magic filter. What it does is keep the sensitive stuff to a minimum, and out of your permanent records.

And the clinical side of your work, the notes, the files, the actual care, has its own footing under the health-care rules. That's your world, and your own basis to set. The phone line is the front door, not the filing cabinet.

Conversegy answers calls for dental practices, physio clinics and vets across Ireland, with this same light-touch approach to sensitive details.

The GDPR doesn't require your data to stay in the EU. It requires that any trip outside the EU is covered by an approved safeguard.

So the real question isn't "does any data leave Ireland?". It's "is every transfer properly covered?".

Here's how it works.

Personal data can move outside the EU, but only under one of a set of recognised safeguards. The two that matter most here are an "adequacy decision", a formal EU ruling that a country protects data well enough, and "standard contractual clauses", a set of binding legal terms that travel with the data wherever it goes.

For the United States, there's a scheme called the Data Privacy Framework that many well-known providers sign up to. It's valid today. It has also been challenged in the courts, more than once, so sensible providers back it up with the standard clauses as well. Belt and braces.

So be a little wary of a bold "your data never leaves the EU" badge.

Sometimes it's true, and it's a fine thing to offer. But often the tools underneath, the voice, the phone network, the software, are run by international companies, and the data does travel. Lawfully, under those safeguards. A provider claiming a fully EU stack is either genuinely running one, which is rarer than the badges suggest, or stretching the truth.

The GDPR doesn't set a fixed period. It says keep it only as long as you actually need it, and be able to say why.

At Conversegy, the call recording and transcript we hold are set to delete automatically after 30 days. Long enough to sort out any query about a call. Short enough that nothing lingers.

There's no magic number in the law.

The GDPR won't tell you "keep calls for 30 days" or "delete after a year". It sets a principle instead. Hold personal data only for as long as you have a real reason to, then let it go. And be able to explain your reason if anyone asks.

So the job is to pick a sensible period for your purpose, write it down, and stick to it.

Here's what Conversegy does.

The recording of a call and its transcript are set to delete on their own after 30 days. You don't have to remember to clear anything. It just happens. That window is there so you can settle a "what did they say on Tuesday?" query, and no longer.

One thing worth being clear on, so there's no surprise.

The 30 days covers our copy. The text summary we send you the moment a call ends is now sitting in your phone. And if a booking went into your calendar, or a detail into your records, that's in your systems too. Those copies are yours. They live as long as you decide they should, under your own retention.

We can only auto-delete what we hold. The rest is your call. Which is exactly as it should be, since you're the controller.

And if a caller ever asks you to delete what you have on them, that's a right they have. You handle the request as the controller. We help by wiping our copy on your say-so. Recordings, transcripts and summaries all count as their data, so all of it is in scope.

Two things, and both up front. That they're speaking to an AI, and that the call is being handled, and why.

Telling callers it's an AI isn't just good manners anymore. Since August 2026, the EU AI Act makes it the law. And the older GDPR rule still stands: people should know a call is being recorded before it starts, not after.

Start with the new one, because it's caught a lot of people out.

The EU AI Act came into force on the 2nd of August 2026. One of its plainest rules: if an AI is talking to a person, that person has to be told they're dealing with an AI. Not buried in small print. Up front, at the start of the conversation.

There's a narrow let-off, for cases where it's already obvious. But here's the catch. The better and more natural an AI voice sounds, the less it can lean on "obvious". A voice good enough to be mistaken for a person is exactly the voice that has to own up to being one. So for a modern phone assistant, the honest answer is simple. Just say it.

The duty is shared, which works in your favour.

The company that builds the AI has to bake the disclosure in. The business that uses it has to make sure it happens. So this isn't a job that lands on your desk. A properly built assistant tells callers what it is on its own, and you inherit that.

Then the older rule, the one that's been there all along.

If a call is recorded, people should be told before it starts. Quietly recording and mentioning it later doesn't cut it. And the tired line "this call may be recorded for quality purposes" is wearing thin, because it doesn't really say what's happening. The rules increasingly expect the notice to match the truth.

Which is how Conversegy has always done it.

You don't have to take anyone's word for this. Including ours.

So here's a checklist you can hold up against any AI phone provider, us included. If they can answer these plainly, they've done the work. If they go vague, that tells you something too.