Glossary
GDPR and data processing agreement (DPA)
A data processing agreement sets out, under Article 28 of the EU GDPR, how a service provider may process personal data on behalf of a business.
When a business in the EU uses an AI phone assistant, it remains responsible for its callers’ data as the controller. The provider processes the data on its behalf. For this the GDPR requires a contract that lays down subject matter, duration, type of data, the right to give instructions, security measures and the use of sub-processors. In Germany this contract is known as the “AV-Vertrag” or AVV.
Four points matter most in a review: which sub-processors are involved, in which countries data is processed, on what basis data is transferred to countries outside the EU, and how long recordings and transcripts are kept. The statement “GDPR compliant” is no substitute for this review. With particularly sensitive data, for instance in medical practices or law firms, professional secrecy obligations come on top.
In practice
The work starts before the first call. You conclude the data processing agreement with the provider, read the list of sub-processors and enter the new processing activity in your record of processing activities. Your own privacy notice should mention that calls are handled with the help of a service provider and an AI. Also decide which data the assistant should ask for at all. What it does not collect, nobody has to protect, store or delete. Whether further steps are needed in your case, such as a data protection impact assessment, is a question for a data protection professional.
An example
A GP practice wants an assistant to take appointment requests. Before signing, the owner checks which service providers the vendor uses and where they process the data. She decides that the assistant records only name, date of birth, callback number and the appointment request, and does not ask about complaints or diagnoses. If a patient describes symptoms anyway, the assistant refers him to the practice team. That keeps the amount of sensitive data small before a single call takes place.
A common misunderstanding
A signed data processing agreement is often read as proof that everything is settled. It only governs the relationship between you and the service provider. Your own duties remain: informing people, clarifying the legal basis, keeping to deletion periods, answering access requests. The second misconception is that a server location in the EU answers every question. The whole chain has to be examined, including the language model, telephony and further sub-processors.
At Call0
The provider of Call0 is Call0 Inc. in the USA. The privacy policy names all service providers with their processing locations; according to the terms, the data protection terms for processing on behalf of the customer are agreed electronically before processing begins.
Source: Regulation (EU) 2016/679 (GDPR), Art. 28
This entry explains the general principle, with a focus on German and EU law, and is not legal advice. For your case, the text of the law and the advice of a qualified professional apply.
Related terms:
Read on:
On this topic:
As of: 12 October 2026