The GDPR is the EU’s General Data Protection Regulation. It defines when and how personal data may be processed in the EU. For an AI phone assistant all four core principles apply: lawful basis, purpose limitation, data minimisation and transparency.
In a telephony context this means concretely: a clear notice at the start of the call that callers are talking to an AI; a lawful basis for processing (typically performance of a contract or legitimate interest with a documented balancing test); a Data Processing Agreement (DPA) with the vendor; and EU data residency for audio, transcripts and metadata.
A setup is only court-defensible when retention periods, deletion procedures and data-subject rights (access, deletion, objection) actually work in production — not just exist in the privacy policy.