A Data Protection Impact Assessment (DPIA) is mandatory under Art. 35 GDPR whenever a processing activity is "likely to result in a high risk to the rights and freedoms of natural persons". AI-driven voice processing with recording and automated tagging routinely falls in that bracket — even at SMB scale.
A defensible DPIA documents at minimum: purpose and necessity of the processing, categories of data subjects, data types, sub-processors, retention period, risks (re-identification, profiling, data breach), and concrete technical and organisational countermeasures.
Templates from supervisory authorities (BayLDA, ICO, CNIL) work as a baseline scaffold but do not replace the organisation-specific assessment. Results must be kept under version control and updated whenever the processing materially changes (new use case, new vendor).