The short version
If your chatbot, AI receptionist or automated follow-up handles information about identifiable people — and it does — that is personal data under UK GDPR. The obligations are not onerous for a small business, but they are real, and retrofitting them after a complaint is far more painful than building them in.
In practice there are five things to get right: lawful basis, transparency, retention, security and data subject rights.
Lawful basis
For handling an enquiry someone has voluntarily made, you will usually rely on either legitimate interests or steps taken prior to entering a contract. Responding to someone who asked you a question is squarely within what they expect.
Where it changes is marketing. Using enquiry data to send unrelated promotional messaging later is a different purpose and generally needs consent under PECR, particularly for SMS and email marketing to individuals and sole traders. Keep the two clearly separated.
Transparency: what you must tell people
- That they are interacting with an automated system — not buried in a policy, but visible at the start of the conversation.
- What you do with what they tell you, in plain language.
- How long you keep it.
- Who else processes it on your behalf, at least by category.
- How they can access, correct or delete their data, and how to complain.
- For calls: that the call is being recorded and processed, announced before the conversation begins.
Retention: the one most small businesses get wrong
The default behaviour of most systems is to keep everything forever. That is not compliant, and it is also a liability — data you no longer need is data that can still be breached.
Set a defined period per data type and enforce it automatically. Something like: unconverted enquiry conversations twelve months, call recordings six months, customer records for the duration of the relationship plus the period you need for tax and legal purposes. Write the periods down, apply them automatically, and review them annually.
Call recording specifics
Recording business calls in the UK is lawful with appropriate notice and a proper lawful basis. The practical requirements are: announce it before the conversation starts, explain why, keep recordings only as long as you need them, restrict who can access them, and be able to provide a copy on request.
AI transcription adds a processing step but does not change the principles. It does mean you should know where transcription happens and be able to say so.
Automated decisions
UK GDPR restricts solely automated decisions that produce legal or similarly significant effects on someone. Booking an appointment or answering a question is not that. Automatically rejecting a job application or a credit request could be.
For most small business automation this simply does not arise — but if you are automating screening in recruitment or lending, keep a meaningful human decision in the loop and document it.
A practical checklist
- Privacy policy updated to cover the chatbot, call recording, transcription and automated follow-up.
- Clear automated-system disclosure at the start of chats and calls.
- Documented lawful basis for each processing purpose.
- Defined, automatically enforced retention periods.
- Working opt-out on every marketing message, honoured immediately and permanently.
- A record of processing activities — for a small business this is a spreadsheet, not a project.
- A route for subject access requests that someone actually owns.
- Data processing terms in place with your suppliers.
Note: This is general information for UK small businesses, not legal advice. For anything complex or high-risk, take advice from a data protection professional. The ICO publishes free, readable guidance and a dedicated SME helpline.
Where Swift Solution fits
We build and manage the whole system for UK small businesses — website, AI chatbot, AI voice receptionist, lead pipeline and process automation — for a monthly fee with no long contract: from £297 for the website, chatbot and follow-up, or from £497 with the AI receptionist. If you would rather not assemble it yourself, book a free consultation and we will tell you honestly whether it is worth doing for your business.