AI receptionists, call recording and UK GDPR: a plain-English guide for restaurants

Is it legal to record phone calls in the UK as a business?

Generally yes, provided you have a lawful basis under UK GDPR, you tell callers before or at the start of the call, and you don't keep recordings longer than you need them. The ICO's own guidance uses recording helpline calls for training as an example of processing that can rely on legitimate interests.

Legitimate interests means passing a three-part test: is there a legitimate purpose, is recording necessary for it, and do the caller's interests override it? For many restaurants, the honest answer is that full audio recording isn't necessary — a written transcript or summary does the job with less intrusion.

That's why Stafff has call recording off by default. It keeps transcripts so your team can see what was said, and if recording is ever switched on, callers are told.

Do you have to tell callers they're talking to an AI?

You should. ICO guidance on fairness and transparency says you must be clear, open and honest with people about who you are and how you use their information, and that if anyone is deceived or misled when their data is collected, the processing is unlikely to be fair.

In practice, say it in the first sentence and never deny it. Stafff's greeting does this — “Hi, you've reached Trattoria Rosa. I'm the restaurant's virtual assistant” — and it always says it's an AI if a caller asks. Callers also have an easy route to a person through messages or live transfer.

Say it in the first sentence, and never deny it. Transparency is cheaper than a complaint.

What's the difference between call recordings and transcripts under GDPR?

Both are personal data, because both identify a caller and what they said. A recording also captures their voice, which people tend to see as more intrusive, and it's larger and harder to search or redact.

• Recording: full audio. Useful for disputes or training; highest privacy impact.
• Transcript: the words, in text. Useful for checking a booking or message; easier to review and delete.
• Summary: a few lines on what the caller wanted. Often all front of house needs.
• Whichever you keep, include it in your privacy notice and your retention schedule.

What lawful basis covers an AI receptionist taking bookings?

Most booking calls sit comfortably under the ‘contract’ basis, because the caller asks you to reserve a table and you need their name and number to do it. Keeping transcripts for quality and follow-up is more likely to rely on legitimate interests, with a short written assessment.

Consent isn't the only option and often isn't the best one. The ICO notes that if you do rely on consent — for example for call transcripts — it must be freely given, specific and informed. Health details such as allergies can be special category data, which needs an extra condition; the simplest protection is to collect as little as possible and hand those calls to staff, which is what Stafff does.

How long should you keep call transcripts and booking data?

No longer than you need them. UK GDPR doesn't set fixed periods; the ICO's storage limitation guidance says you must be able to justify how long you keep data and should review and delete what you no longer need.

• Set a period for each type: bookings, transcripts, messages, recordings if any.
• Tie it to a reason, such as resolving booking disputes or reviewing missed messages.
• Ask your provider how long it keeps transcripts and whether you can change that.
• Delete allergy notes and old guest numbers with the rest of your booking clear-out.

Who is responsible — the restaurant or the AI provider?

Usually the restaurant is the controller, because it decides why caller data is used, and the AI provider is a processor acting on its instructions. UK GDPR requires a written contract between them — normally a data processing agreement (DPA).

Stafff acts as processor for each restaurant and has a DPA available. Data is hosted in Europe, each restaurant's data is kept separate, owner and staff admin accounts use multi-factor authentication, changes are logged, and Stafff never handles card numbers. Whichever provider you choose, ask for its DPA, where data is stored and which sub-processors it uses.

What should your greeting, privacy notice and texts say?

Tell callers the essentials at the start of the call and put the detail in your privacy notice. ICO guidance on the right to be informed says privacy information must be given at the time you collect people's data.

• Greeting: the restaurant's name, that it's a virtual assistant, and whether the call is recorded.
• Privacy notice: who you are, what you collect on calls, why, your lawful basis, who processes it, how long you keep it, and people's rights — including complaining to the ICO.
• Booking confirmation texts are service messages. Marketing texts are different and need consent or a valid soft opt-in under PECR.
• This guide is general information, not legal advice. Check with your adviser or the ICO's guidance for your situation.