AI Receptionist, GDPR and the AI Act: What Danish Businesses Need to Know

When an AI receptionist answers the phone, or an AI widget on your website takes a booking, it processes personal data: name, phone number, perhaps an address and a reason for contact. That is no reason not to do it — but a reason to do it properly. Here are the rules that apply in 2026, explained without legal jargon. This article is general information, not legal advice.

1. GDPR: the same rules as for a contact form

• Purpose and basis: You may process the data to handle the request and the booking. Don't use it for anything else without a new basis.
• Data minimisation: Ask only for what is necessary. A hairdresser doesn't need a national ID number.
• Data processing agreement: The AI provider processes data on your behalf and must have a data processing agreement with you.
• Storage and deletion: Agree how long conversations, recordings and transcripts are kept.
• Transfers outside the EU: Ask where data is processed. Processing in the EU is simplest.
• Duty to inform: Describe the use of AI and recording in your privacy policy.

2. Recording phone calls

Many AI solutions record and transcribe calls so you can see what was agreed. The Danish Data Protection Agency has guidance on recording phone calls: you need a lawful basis, e.g. a legitimate interest in documentation that outweighs the caller's interest in not being recorded, and you must inform about the recording. If the conversation contains sensitive data — e.g. health — stricter rules apply. So say in the greeting that the call is recorded, and set the AI up not to ask about health matters unless necessary.

3. The AI Act: say it is an AI

The EU AI Act (Regulation 2024/1689) contains transparency requirements in Article 50 that apply from 2 August 2026: AI systems that interact directly with people must be designed so that those people are informed they are interacting with an AI system, unless this is obvious. An AI receptionist or chatbot is not high-risk AI, but it is covered by this requirement. The EU's "digital omnibus" from summer 2026 postponed the rules for high-risk AI, but according to legal analyses not this requirement.

In practice: the greeting should say something like "You are speaking with [business]'s digital assistant". That is also what customers respond to best.

4. Outbound calls and marketing

If the AI calls out, the Marketing Practices Act also applies. Automated calls for direct marketing require prior consent. Reminders about booked appointments are service. See the rules for outbound AI calls.

Questions for your provider

1. Where is conversation data processed and stored — in the EU?
2. Do you have a standard data processing agreement, and which sub-processors do you use?
3. How long are recordings and transcripts kept, and can I change it?
4. Can a customer's data be found and deleted on request?
5. Is data encrypted in transit and at rest?
6. Can I decide the greeting myself, so the AI says it is an AI and that the call is recorded?
7. Are my customers' conversations used to train your or others' models?

How Aibooking.dk handles it

Data is processed in the EU with encrypted storage, agreed deletion rules and a data processing agreement. Recordings and transcripts are only available to you, and you decide the wording of the greeting yourself. Read our privacy policy, or see how it fits with the technology in the latest AI technology in 2026.