GDPR and Voice AI: Keeping Call Data Inside Your Borders

Under the GDPR, the business running a voice agent is generally the controller. Each outside party that handles the call is a processor, and processing outside the EU is a transfer. The Regulation sets no EU storage rule. Self-hosting the platform and open-weight models in the EU leaves the carrier as the main outside party.

Key Takeaways

• The business running the agent is generally the controller; each outside party is a processor.
• Remote access from outside the EU can be a transfer, even with EU storage.
• Self-hosting with open-weight models in the EU leaves mainly the phone carrier outside.

This post is part of our guide to compliant AI voice agents. The guide's section "Privacy law: GDPR, controllers and processors" opens with one rule: "the business running the agent is generally the controller, and every outside party that handles the call on its behalf is a processor." Here is that rule article by article, and how it plays out in Dograh, an open-source, self-hostable voice agent platform.

What the GDPR says about voice data

The GDPR never names voice, yet a recorded call is generally personal data from the first word. Article 4(1) of the GDPR defines personal data as "any information relating to an identified or identifiable natural person". A caller's voice, number and words relate to someone identifiable, so the recording, transcript and extracted fields generally fall inside it.

Biometric data is narrower. Article 4(14) covers personal data from "specific technical processing" of a person's characteristics "which allow or confirm the unique identification of that natural person". The European Data Protection Board says in its guidelines on virtual voice assistants: "The EDPB recalls that voice data is inherently biometric personal data." The same paragraph applies the stricter Article 9 rules to processing "for the purpose of uniquely identifying a natural person".

So an ordinary booking or support call is generally personal data. It becomes special-category data when you use the voice to identify the caller, as a voiceprint login does, or when the caller shares health details. Why voice data needs to stay local covers the voiceprint case.

Controller and processors: who hears the call

The business that decides to run the agent is generally the controller, whichever platform it uses. Spain's data protection authority, the AEPD, takes the same view. In Covington's summary of the AEPD guidance, the line is "Organizations using AI transcription tools act as controllers".

Every outside party that handles the call on your behalf is generally a processor. Article 28(1) sets the duty that follows: the controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures". Each processor needs a contract, and each one's own subprocessors join the list.

Bringing your own API keys changes whose contract covers the audio. The audio itself still reaches the provider, so each hosted model stays on your processor list.

Transfers: where the call is processed or reached

Chapter V of the GDPR governs personal data leaving the EU, and storage inside the EU does not settle that question alone. Article 44 says a transfer to a third country "shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor". Article 46(1) allows one without an adequacy decision only where the controller or processor "has provided appropriate safeguards".

Access counts as well as storage. DLA Piper's GDPR fines and data breach survey reports a decision against TikTok over transfers to China, and calls it "the first that concerns remote access as opposed to data storage". A model provider processing audio in another region, or a support team abroad opening EU call records, can generally raise the same question.

The GDPR generally sets no rule that call data must be stored in the EU. EU residency usually comes from customer contracts, sector rules or your own policy. When you need it, the data residency checklist for voice AI lists every place call data can leave.

Self-hosting in the EU with open-weight models

The shortest processor list comes from running the platform and the models in your own EU data centre. A self-hosted install runs with Docker Compose on servers you pick, so call records, along with their recordings and transcripts, sit in your own database and object storage. Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. The call audio stays in-house only when the speech and language models run on your own servers too. With open-weight speech-to-text, LLM and text-to-speech models running in the same data centre, no model provider hears the call.

Dograh starts every account on its own managed models. To keep call audio away from Dograh, open Models, switch the Organization default to BYOK with your own speech and language providers (or local models), and check that no agent has its own model override. Running Voice AI on Local, Self-Hosted Models covers which models fit on which server.

A few things still need a setting. Every call over the phone network passes through your carrier; browser calls do not. Telemetry is on by default in the Docker setup. Set ENABLE_TELEMETRY=false, and remove POSTHOG_API_KEY from the api service in docker-compose.yaml (or set it to an empty value). The quickstart also opens a public trycloudflare.com tunnel to the API, which a production install replaces with its own domain.

Claim EU data location only when Dograh and the models both run in an EU data centre. Dograh Cloud handles the security work for you. For residency, teams can self-host Dograh inside their existing compliance perimeter, or use a private-cloud deployment where Dograh runs the stack inside their own VPC. Dograh's Managed SIP regions (Global, India, UAE) are phone routing, not data residency. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Security, retention and erasure on your servers

Self-hosting moves the security work onto you along with the data. Article 32(1)(a) asks controllers and processors for measures "to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data".

In practice, access control and encryption become your job, and so do backups. Dograh has no retention setting and deletes nothing automatically, so your storage policy decides how long calls are kept, and you handle an erasure request in your own storage. Recording upload can be switched off only for the whole server, with ENABLE_CALL_RECORDING_UPLOAD=false, and transcripts are still saved.

Recordings and transcripts keep whatever is said, so the call never asks for a full account, card or Social Security number; use a short check such as the last four digits, and send payment links by text or email from your own system. Audit logs are listed on Dograh's Enterprise plan. On a self-hosted install, your own infrastructure's access logs are what show who opened which recording.

UK callers fall under UK GDPR, which uses the same controller and processor roles. AI voice agents for UK hospitals and health systems applies them to patient calls.

AI disclosure under the AI Act

Since 2 August 2026, the EU AI Act has added a disclosure duty for AI systems that talk to people. Article 50(1) of the AI Act says providers must ensure such systems are designed so that "the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious". Who counts as the provider in your setup is a question for counsel.

If you want to tell callers they're speaking with an automated assistant, or your location requires it by law, write it in the Greeting Text along with the business's name. Dograh plays that line word for word as the call connects, so the wording never drifts.

This is general information, not legal advice. Confirm your position with counsel, or in the UK, check with a data protection adviser.