If you are thinking of letting software answer your business phone, a fair question comes first: is it allowed? This guide sets out the rules that apply in the UK, with links to the law itself and to guidance from the ICO, the UK's data protection regulator.
This is general information, not legal advice. The rules depend on your business and how you use the service. If you are unsure, speak to a solicitor or a data protection adviser.
The short answer
Yes. No UK law stops a business from using an AI receptionist to answer its calls. The same rules apply as for any other way of handling calls:
- Data protection law, because callers give you personal information.
- The rules on recording calls, if calls are recorded.
- The rules on marketing texts and emails, if you use callers' details to market to them.
Callers' details are personal data
A call carries personal data: the caller's name and number, what they ring about, and the recording and transcript. That brings in the UK GDPR and the Data Protection Act 2018.
- You are the controller. Your business decides why callers' details are used. The company that runs your AI receptionist is your processor: it handles the data for you, on your instructions. The ICO explains the difference in its guidance on controllers and processors.
- You need a written contract with your processor. Article 28 of the UK GDPR sets out what it must cover, and the ICO has guidance on contracts between controllers and processors.
- The principles still apply. Article 5 says personal data must be used lawfully, fairly and openly, limited to what you need, kept no longer than necessary and kept secure.
- Health details need extra care. If callers tell you about their health, as they may with a clinic or a dental practice, that is special category data under Article 9, which needs an extra condition for using it. Check your privacy notice covers calls.
Tell callers what happens to their call
The ICO's guidance on the right to be informed says you must give people privacy information, such as why you use their data, how long you keep it and who it is shared with, at the time you collect it. The detailed list is in Article 13.
In practice, that usually means two things:
- A short line at the start of the call, for example that calls are recorded.
- A privacy notice, on your website for example, that covers phone calls and names the service that answers them.
Recording calls
The Investigatory Powers Act 2016 and the business monitoring regulations made under it let a business record calls on its own phone system for purposes such as keeping a record of what was said and checking standards. One of the conditions is that the business has made all reasonable efforts to tell the people who use the system that calls may be recorded.
The recordings and transcripts are personal data too, so the data protection rules above apply to them: tell callers, keep them only as long as you need them, and keep them secure. If your business is regulated, by the Financial Conduct Authority or the Solicitors Regulation Authority for example, check your regulator's own rules on recording and keeping calls.
Being open that it is an AI
UK data protection law does not set the words an AI receptionist must use. It does require you to use people's information fairly and openly, and the ICO's guidance on AI and data protection has a section on transparency. The ICO says that guidance is under review following the Data (Use and Access) Act 2025, so check it for updates.
The simplest course is not to pretend. Tilly sounds like a person, but she never says she is one: if a caller asks, she says she is your AI receptionist and carries on helping.
Texts and emails to callers
If you use callers' numbers or email addresses for marketing, the Privacy and Electronic Communications Regulations apply. The ICO's guidance on electronic mail marketing sums them up:
- You must not send marketing emails or texts to individuals without their specific consent.
- The exception, often called the soft opt-in, covers your own customers who bought, or discussed buying, a similar product or service from you, as long as you gave them a simple way to opt out when you took their details and in every message since.
- Sole traders and some partnerships count as individuals.
Messages a caller asks for are not the same as marketing sent unasked. Tilly only sets a reminder text after a caller clearly says yes, and keeps a record of what they agreed to. Her missed-call text invites a caller who rang off to call back. Both kinds of text end with a link to stop texts. If you write your own wording for the missed-call text, keep it about the missed call, not a promotion.
A short checklist
- Make sure you have a written data processing agreement with your AI receptionist provider.
- Tell callers at the start of the call that calls are recorded, if they are.
- Update your privacy notice to cover phone calls, recordings, transcripts and the service you use.
- Decide how long you need recordings and messages, and check the provider deletes them on a schedule.
- Know how you will handle a caller who asks for a copy of their data or asks you to delete it.
- Keep marketing to callers within the consent and soft opt-in rules.
How Tilly helps
- A data processing agreement under Article 28 is part of signing up. You can read our data processing agreement and privacy policy before you start.
- Sub-processors and safeguards are listed. The agreement names every company that helps run the service, where it processes data, and the safeguard used for any transfer outside the UK. Our database is hosted in the UK.
- Callers are told when calls are recorded. Calls are recorded only if you add call recordings. Then her greeting includes "Just so you know, calls are recorded." If you turn this off, telling callers is up to you. Without recordings, calls are written down as transcripts but no audio is kept.
- She is honest that she is an AI, and never takes card or bank details over the phone.
- Data is deleted on a schedule. Call audio and transcripts held by our voice provider are deleted after a set time, and an account's data is deleted after it closes, as our privacy policy sets out.
- You can erase a caller. If someone asks you to delete their details, you can erase their contact record from your dashboard. See call summaries and contacts.
To see how the rest of the service works, read what an AI receptionist is, or hear Tilly answer a call.
Checked against legislation.gov.uk and the ICO's guidance on 15 October 2026. This guide is general information, not legal advice.