Compliance and legislation
GDPR and the EU AI Act — how YourReceptionist is built to comply with the rules
AI-based telephone answering is regulated by two sets of rules at the same time: data protection rules, which apply to anything that processes personal data, and the EU's new AI Act, which sets specific requirements for systems that talk to people. YourReceptionist complies with both — and this page explains the framework, what it means for your business, and how we ourselves meet the requirements.
The legal framework
Danish law and EU regulationThree sets of rules are relevant when a business uses an AI telephone receptionist to answer calls from its own customers, patients or members of the public.
General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679 applies to all processing of personal data — including callers' phone numbers, names, audio recordings and transcriptions. It sets requirements for legal basis, security, data processing agreements and data subjects' rights.
Danish Data Protection Act
The Danish law that supplements GDPR nationally and which, among other things, designates the Danish Data Protection Agency (Datatilsynet) as the supervisory authority, along with specific Danish rules on e.g. CPR numbers and certain sectors, including healthcare.
AI Act, Article 50
Regulation (EU) 2024/1689 requires that systems such as chatbots and voice-based AI assistants are designed so that anyone interacting with the system is informed that it is AI. The requirement applies from 2 August 2026.
How your business complies with the rules
As data controller for your own callersWhen you use YourReceptionist, you are the data controller for the personal data processed about your own callers. Four things are key to complying with the rules.
Inform your callers about AI
Make sure it is clear that calls are answered by an AI assistant — as part of the conversation itself or your own terms, cf. Article 50 of the AI Act.
Ensure a valid legal basis
The personal data YourReceptionist processes on your behalf must have a lawful basis under GDPR Article 6 — typically contract or legitimate interest in connection with customer enquiries.
Enter into a data processing agreement
GDPR Article 28 requires a written data processing agreement when a supplier processes data on your behalf. YourReceptionist's data processing agreement is accepted digitally when ordering.
Assess sector-specific requirements
Health clinics and other sectors where calls may contain sensitive information should pay particular attention to the security level and retention period for audio recordings and transcriptions.
How YourReceptionist complies with the rules
Our share of the responsibility as a supplierWe are aware that AI-based telephone answering falls under two sets of rules at once. This is how YourReceptionist is built and operated to support both.
Data processing agreement as standard
All customers accept a data processing agreement under GDPR Article 28 when ordering — not as an add-on, but as a fixed part of the agreement.
Data Processing Agreement, Clause 4Encryption and access control
Call data, audio recordings and transcriptions are encrypted both in transit and at rest, and only authorised staff have access.
Data Processing Agreement, Appendix C.2Prompt notification of data breaches
If a security breach occurs, you will be notified no later than 24 hours after we become aware of it, so you can meet your own deadline for notifying the Danish Data Protection Agency (Datatilsynet).
Data Processing Agreement, Clause 10Approved sub-processors
Our use of third-party suppliers (telephony, voice AI, calendar integration) is documented, and transfers outside the EU/EEA take place on the basis of the European Commission's Standard Contractual Clauses.
Data Processing Agreement, Appendix BSupports your AI disclosure obligation
We provide functionality so that it can be made clear in the dialogue that the caller is talking to an AI assistant, in line with Article 50 of the AI Act.
Service Agreement, sections 1.3 and 3.3Deletion or return on termination
When the partnership ends, we delete all personal data — or return it to you — and confirm this in writing.
Data Processing Agreement, Clause 11Our approach to compliance
YourReceptionist operates in a regulatory landscape that is constantly changing — GDPR is well established, but the AI Act is new, and the requirements for transparency about AI-based communication are still developing in practice. We follow developments closely, including guidance from the Danish Data Protection Agency (Datatilsynet) and the European Commission, and update our agreements and product accordingly.
For us, compliance is not a one-off task but part of how we build and operate YourReceptionist. If your business has questions about how the rules apply specifically to your sector or use, you are always welcome to contact us.