- The ICO says callers must be told a call is being recorded and why, and names a recorded message as good practice.
- At the National Living Wage, one full-time receptionist costs about £28,300 a year once employer National Insurance and the minimum pension are added, and covers 37.5 of the week's 168 hours.
- PECR and the TPS matter when the system makes marketing calls, and an automated marketing call needs specific prior consent.
An AI receptionist in the UK comes with duties the vendor demo usually skips. Every call it handles is personal data under UK GDPR: callers need to know who is using their information and why, and whether they're being recorded, and recordings can be kept only as long as you need them. On cost, the honest comparison is the legal minimum for a UK hire: about £28,300 a year for one full-time receptionist aged 21 or over.
What follows describes what the rules and the regulators' guidance say, with a link to each source. It isn't legal advice, so check your own set-up with an adviser.
Who is responsible for what
Your business decides how calls are handled, so it's the controller. A provider acting only on your instructions is your processor, which in the ICO's words "can only process the personal data on instructions from a controller".
Tell callers at the start of the call
When you collect personal data directly from someone, Article 13 of the UK GDPR requires privacy information "at the time when personal data are obtained" (ICO: when to provide privacy information). The ICO lists what it covers, including who you are, your purposes and lawful basis, who receives the data, how long you keep it and people's rights (ICO: what privacy information to provide). On a phone call, the time of collection is the first few seconds.
A spoken greeting can't carry the whole list. One workable pattern is a short line with a pointer to the full notice: "You're speaking to [business name]'s automated assistant. Calls are recorded to keep an accurate record of bookings. Our website's privacy notice explains how we use your information."
Saying it's an AI. The ICO's AI guidance states: "You need to be transparent about how you process personal data in an AI system." Where you collect data directly, privacy information must come "at the time you collect it, before you use it to train a model or apply that model on those individuals" (ICO: transparency in AI). It prescribes no script, and the ICO notes its AI guidance is under review following the Data (Use and Access) Act. Our view: say it in the first sentence.
Decisions the system makes. If it decides things about callers on its own, the ICO's privacy information list adds "meaningful information about the logic involved in the process". Simpler to keep decisions such as refusing a service with a person.
Recording calls and keeping transcripts
If your AI receptionist records or transcribes calls, the ICO's monitoring guidance is blunt about the people on the other end of the line: "You must tell these people that you are recording the call and why." It adds: "A recorded message is good practice." Your own staff must be told about call monitoring too (ICO: monitoring and call recording).
Separately, the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 let a business record communications on its own system for purposes such as establishing facts, on conditions. One is that it "has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted" (SI 2018/356, regulation 4).
In 2023 the ICO reprimanded two police forces over an app that recorded officers' calls; in its words, "people were not informed that their conversations with officers were being recorded" (ICO reprimand).
How long to keep recordings
Personal data must be kept "for no longer than is necessary for the purposes for which the personal data are processed". The ICO puts it plainly: "You must not keep personal data for longer than you need it." You should be able to justify the period, and "You need a policy setting standard retention periods wherever possible" (ICO: storage limitation). Your privacy information must state the period, or the criteria behind it.
An AI receptionist can create three records per call: audio, transcript and a CRM summary. Set a period for each, switch off what you don't use, and check the provider deletes on your schedule.
Your provider, your contract and sensitive calls
- A written contract. The ICO says Article 28(3) means a written contract is needed "every time a controller uses a processor to process personal data" (ICO: contracts). Check it covers retention, sub-processors and whether your calls train its models.
- Where the data goes. Passing personal information to an organisation outside the UK is a restricted transfer, which the ICO says must be covered by adequacy regulations, appropriate safeguards such as the IDTA or the Addendum, or an exception (ICO: international transfers). Ask where audio and transcripts are processed, including by the models underneath.
- Health details. Callers to a clinic mention symptoms. Health data is special category data, needing both an Article 6 lawful basis and an Article 9 condition, and a data protection impact assessment (DPIA) when processed on a large scale (ICO: special category data).
- Innovative technology. The ICO counts "innovative technology", with AI as an example, as a high-risk criterion that requires a DPIA when combined with another. Its list also covers "any processing of biometric data for the purpose of uniquely identifying an individual" (ICO: high-risk processing), so ask whether any voice-recognition feature identifies callers.
Outbound calls: where PECR and the TPS apply
PECR's telephone marketing rules are about calls you make, and the ICO says administrative or customer service calls "don't count as direct marketing if you use them purely for administrative purposes" (ICO: live marketing calls). The line moves the moment a callback promotes something.
Then you "must not make unsolicited live calls" to numbers on the TPS or CTPS without specific consent, which means screening call lists. An automated marketing call needs the person to have "specifically consented to receive this type of call from you"; "General consent for marketing, or even consent for live calls, is not enough" (ICO: telephone marketing, under review after the Data (Use and Access) Act). A lifelike voice doesn't change the category: in September 2025 the ICO fined two energy firms over automated marketing calls whose avatar software played lines recorded by voice actors (ICO announcement). For any callback, Ofcom's guidance expects the number shown to be "a valid, dialable telephone number which uniquely identifies the caller" (Ofcom: CLI guidance).
What a UK hire costs
Vendor comparisons quote a salary and stop. The statutory floor is more useful, since nobody can lawfully pay less. Here's one receptionist aged 21 or over on the National Living Wage, working 37.5 hours a week, at 2026 to 2027 rates.
| Line | Rule | Annual cost |
|---|---|---|
| Pay | National Living Wage of £12.71 an hour from 1 April 2026 | £24,785 |
| Employer National Insurance | 15% on earnings above £5,000 a year | £2,968 |
| Workplace pension | Employer minimum of 3% of qualifying earnings between £6,240 and £50,270 | £556 |
| Total | Before any Employment Allowance | about £28,300 a year |
Rates from GOV.UK minimum wage rates, HMRC employer rates and GOV.UK workplace pensions; the arithmetic is ours. Eligible employers can cut National Insurance by up to £10,500 a year through the Employment Allowance, which can cancel that line for a small firm. Pay above the minimum and every line scales up.
That receptionist covers 37.5 of the week's 168 hours, takes 5.6 weeks' paid holiday a year and answers one call at a time. Software doesn't clock off at 5.30pm. That argues for coverage, not replacement: a person on the front desk, the AI on overflow, evenings and weekends. The main AI receptionist guide breaks down what sits inside an AI plan, and the 24/7 guide prices a round-the-clock human rota.
UK businesses that gain most from AI call answering
The case is strongest where a missed call is a lost job and calls arrive unpredictably. Trades and home services, because a plumber under a sink can't answer and the caller rings the next firm. Clinics and dental practices, with repetitive booking calls and a front desk already on the phone; mind the special category point above, and see AI for dentists. Letting and estate agents, where a slow reply can lose the applicant (AI for estate agents). Professional services, where one new client is worth thousands. Rare, low-value or mostly sensitive calls? A diverted mobile may be the honest answer.
Common questions
Do I have to tell callers they are speaking to an AI?
The ICO expects transparency about how an AI system processes personal data, with privacy information given at the time you collect it, which on a call means the greeting. It prescribes no wording. We recommend saying it in the first sentence, alongside any recording notice.
Do I have to tell callers that calls are recorded?
The ICO's guidance says you must tell callers that you are recording the call and why, and it treats a recorded message as good practice. Recording on your own system under the 2018 interception regulations also depends on having made all reasonable efforts to tell users that calls may be intercepted.
How long can we keep call recordings and transcripts?
No longer than you need them for the purpose you recorded them for. The ICO expects you to justify the period, set standard retention periods where possible and review what you hold. Set separate periods for audio, transcripts and summaries.
Is an AI receptionist cheaper than hiring in the UK?
For cover alone, yes. One full-time receptionist on the National Living Wage costs about £28,300 a year once employer National Insurance and the minimum pension are added, before any Employment Allowance, and covers 37.5 hours a week. An AI plan covers every hour of the week on one monthly plan.
Do PECR and the TPS apply to an AI receptionist?
PECR's telephone marketing rules are about calls you make, so answering inbound calls is not their target. If your system phones people to promote anything, live marketing calls must be screened against the TPS and automated marketing calls need specific prior consent. The ICO has already treated lifelike scripted calls as automated.
Write your greeting before you choose a provider: who is answering, whether the call is recorded and why, and where the privacy notice lives. Two sentences like that quickly show whether a provider's settings, contract and data locations can keep the promise. Bring them to an informal scoping chat with a rough count of the calls you get each month, and we'll test a set-up against them and send a price range.
Sources
Every figure in this article links back to the source below it was checked against.
Legal points quote the ICO, GOV.UK, legislation.gov.uk and Ofcom pages linked beside them and are not legal advice. Employment costs are our arithmetic from GOV.UK rates. We don’t publish AI plan prices; a price range follows a scoping chat.
Discuss your own requirements ↗