GDPR Compliance at AI Receptionist Ireland
How we handle caller data, the documentation we hold from our technology suppliers, and what we provide to clients on request.
Every call handled through our service involves personal data belonging to real people. We operate two deployment tiers. Tier A applies to standard SME clients, operating under Module 3 Standard Contractual Clauses with zero audio retention as the primary technical safeguard. Tier B applies to high-compliance clients in regulated sectors or those with mandatory EU data residency requirements, where all processing occurs exclusively within the European Economic Area.
Tier B is available to any business that needs it. You do not have to be in a regulated sector to request it. Every client, regardless of tier, receives a full Data Processing Agreement, sub-processor schedule, and caller disclosure documentation before going live. To request the full Client Compliance Pack, contact [email protected].
Voice processing under Module 3 SCCs with zero audio retention. No call data persists beyond the session.
Infrastructure
(EEA)
All processing within the EEA. No US transfers. Full EU data residency from first ring to inbox delivery.
Client-Facing Compliance Documents
The following documents are available to clients on request. Clients in regulated sectors will receive these as standard before going live. Any client may request them at any time.
- Data Processing AgreementArticle 28 compliant, including sub-processor schedule
- Data Flow ArchitectureA plain English diagram showing exactly where your callers' data goes from the moment they ring to the moment it reaches your inbox
- Sub-Processor ScheduleA named list of every platform that touches your call data, with their location and transfer mechanism
- EU-US Data Privacy Framework CertificationConfirming adequacy status under Article 45 where applicable to our infrastructure partners
- Transfer Impact AssessmentConfirming our assessment of data transfer risks under US surveillance law provisions
- Standard Contractual Clauses ConfirmationSecondary safeguard under Article 46: Module 3 Processor-to-Processor SCCs executed across our voice processing stack
- SOC 2 Type II Audit ReportIndependent verification of security controls across our voice infrastructure
- ISO 27001 CertificateInformation security management certification
- ISO 27701 CertificatePrivacy information management certification
- Encryption Standards StatementConfirming AES-256 encryption at rest and TLS 1.3 in transit across our full stack
- Caller Data Rights NoticeArticle 13-compliant notice informing callers of the identity of the data controller, the purpose of processing, the legal basis, and how to exercise their data subject rights. Issued to clients for display on their business website or telephone greeting.
- AI Disclosure ScriptThe exact verbal disclosure played to every caller at the start of the call, confirming they are speaking with an automated AI system. Mandatory under both Article 13 GDPR and Article 50 of the EU AI Act.
- Data Minimisation PolicyConfirming the specific data points captured on every call, the justification for each, and the technical controls preventing any collection beyond those points.
- Zero Retention AddendumA signed addendum confirming that no voice audio or call transcript persists on any third-party server following call completion. Applicable to all Tier A and Tier B deployments.
- No-Training ConfirmationWritten assurance that no call data processed through our service is used to train, fine-tune, benchmark, or otherwise improve any AI model, by us or any sub-processor.
- Breach Response ProcedureOur documented process for identifying, containing, and notifying you of any personal data breach within 48 hours of detection. Client notification is followed by a formal report to the Irish Data Protection Commission within 72 hours in line with Article 33.
- Go-Live Compliance CertificateIssued to each client at deployment, confirming that all contractual, technical, and operational compliance requirements have been satisfied before the service goes live.
- Data Protection Impact Assessment TemplateA pre-populated working document your compliance team can adapt for internal records, satisfying Article 35 requirements for high-risk processing activities.
- EU Data Residency Architecture ConfirmationWritten technical confirmation that all voice processing, webhook routing, and data delivery occurs exclusively within the EEA, with no international data transfers at any stage of the call lifecycle.
- Client Disclosure Sign-Off RecordA signed acknowledgement confirming that the deploying business has reviewed and accepted the data processing terms, AI disclosure obligations, and data subject rights procedures prior to go-live.
All documents listed above are available on request. Regulated sector clients receive the full pack as standard before go-live. To request the complete Client Compliance Pack for your business, contact [email protected].
Our Supplier Document Holdings
We hold compliance documentation across two categories of technology supplier: the platforms that handle call data directly during a call, and the automation platforms used after the call has concluded.
These are the platforms through which calls are answered, processed, and transcribed. They represent the primary data processing touchpoints in our service.
- Data Processing Addendum (DPA)Executed
- Sub-Processor Directory
- SOC 2 Type II Audit Report
- ISO 27001 Certificate
- ISO 27701 Privacy Information Management Certificate
- Standard Contractual ClausesModule 3: Processor to Processor
- Transfer Impact AssessmentCovering data transfer risks under applicable surveillance law provisions
- No-Training ConfirmationWritten confirmation that no client call data is used to train AI models
Transfer safeguard in use: Standard Contractual Clauses (Module 3, Processor-to-Processor) with zero audio retention configured as the primary technical measure. No call audio persists beyond the session. Transcripts are routed directly to the client inbox and are not stored on any third-party server.
These are the platforms used after a call has concluded to route summaries, fire webhooks, and deliver information to client inboxes.
- Data Processing Addendum (DPA)Executed
- EU Infrastructure ConfirmationWritten confirmation that data is processed and stored within the EEA
- Sub-Processor List
- Standard Contractual Clauses Confirmation
GDPR Articles by Sector
The table below shows which GDPR articles are relevant depending on your sector. Legal and medical clients carry additional obligations due to the sensitive nature of data they handle.
| Article | Name | Legal | Medical | Standard SME |
|---|---|---|---|---|
| Art. 4 | Definitions | ✓ | ✓ | ✓ |
| Art. 5 | Principles of Processing | ✓ | ✓ | ✓ |
| Art. 6 | Lawful Basis for Processing | ✓ | ✓ | ✓ |
| Art. 7 | Conditions for Consent | ✓ | ✓ | ✓ |
| Art. 9 | Special Category Data | ✓ | ✓ | |
| Art. 10 | Criminal Conviction Data | ✓ | ||
| Art. 12 | Transparent Information | ✓ | ✓ | ✓ |
| Art. 13 | Information at Point of Collection | ✓ | ✓ | ✓ |
| Art. 17 | Right to Erasure | ✓ | ✓ | ✓ |
| Art. 18 | Right to Restriction | ✓ | ✓ | ✓ |
| Art. 20 | Right to Portability | ✓ | ✓ | ✓ |
| Art. 22 | Automated Decision Making | ✓ | ✓ | ✓ |
| Art. 24 | Responsibility of Controller | ✓ | ✓ | ✓ |
| Art. 25 | Data Protection by Design | ✓ | ✓ | ✓ |
| Art. 28 | Processor Obligations | ✓ | ✓ | ✓ |
| Art. 28(2) | Sub-Processor Authorization | ✓ | ✓ | ✓ |
| Art. 28(3) | DPA Mandatory Contents | ✓ | ✓ | ✓ |
| Art. 28(4) | Sub-Processor Flow-Down | ✓ | ✓ | ✓ |
| Art. 32 | Security of Processing | ✓ | ✓ | ✓ |
| Art. 33 | Breach Notification to DPC | ✓ | ✓ | ✓ |
| Art. 34 | Breach Notification to Individuals | ✓ | ✓ | ✓ |
| Art. 35 | Data Protection Impact Assessment | ✓ | ✓ | |
| Art. 44 | General Transfer Principle | ✓ | ✓ | ✓ |
| Art. 45 | Adequacy Decision | ✓ | ✓ | ✓ |
| Art. 46 | Appropriate Safeguards | ✓ | ✓ | ✓ |
| Art. 83 | Administrative Fines | ✓ | ✓ | ✓ |
Legal sector triggers Articles 9 and 10 due to the nature of family law, criminal litigation, personal injury, and probate matters. A DPIA under Article 35 is strongly recommended. Medical sector triggers Article 9 due to health data being special category. A DPIA under Article 35 is strongly recommended. Standard SME clients, trades, gyms, beauty, moving, and similar, fall under standard GDPR obligations. Name, phone number, and reason for call are the only data points captured through our service for these clients.