Do we need each caller's consent to record calls?

Not under the interception rules, if the recording is for a permitted purpose and you have made all reasonable efforts to tell callers. You still need a UK GDPR lawful basis, which does not have to be consent, and you must explain the recording in your privacy information.

What should the AI agent say at the start of a call?

Something like: 'You're through to the clinic's AI assistant. This call is recorded and transcribed so we can help you and keep accurate records. You can ask to speak to a member of staff at any time.' Keep it short and before any patient detail is shared.

Do we have to tell callers they are speaking to an AI?

Telling callers is the safest course. UK GDPR requires you to be transparent about how personal data is processed, and the ICO treats transparency as central to AI. Callers who discover later that they were speaking to an AI are more likely to complain.

Does PECR apply to an AI receptionist?

Mostly not for inbound calls. PECR mainly governs electronic marketing. It matters if the agent makes outbound marketing calls: automated marketing calls need the person's specific prior consent, and every automated call must give your name and contact details.

Can a patient ask for a copy of their call recording?

Yes. A recording or transcript that identifies the caller is their personal data, so it falls within the right of access while you hold it. Know where recordings are kept and how to retrieve one quickly.

How long should we keep call recordings?

Only as long as you need them for the purpose you gave callers, such as resolving queries or complaints. Set a period, write it into your privacy notice and DPIA, and make sure the vendor deletes on schedule.

Does recording calls affect our staff?

Yes. Staff who use recorded lines should be told, and your staff privacy notice should cover it. The same reasonable-efforts duty to inform applies to everyone who may use the system.

AI Receptionist Call Recording Law UK: Interception Rules, UK GDPR and PECR

Short answer

Yes, provided callers are told. UK law lets a business record calls on its own system for purposes such as establishing facts and checking standards, if it makes all reasonable efforts to tell callers. UK GDPR then requires a lawful basis, privacy information and retention limits. PECR matters if the agent makes automated marketing calls, which need specific prior consent.

The interception rules: tell callers

Recording calls is interception of communications, which the Investigatory Powers Act 2016 controls. Section 46 and the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 allow a business to record communications on its own system without each caller's consent, for listed purposes. These include establishing the existence of facts, checking compliance with regulatory rules, and checking the standards of staff using the system. A key condition is that the business has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted.

In practice that means a clear message at the start of the call, plus a line in your privacy notice and on your website. Apply the same rule to staff: tell your team which lines are recorded.

UK GDPR: recordings are patient data

A call recording and transcript are personal data, and when a patient describes symptoms they are health data too, which makes them special category data. You need a lawful basis and an Article 9 condition, privacy information that explains the recording and why, a defined retention period, and a process for patients who ask for a copy. Cover the phone agent in your DPIA; it processes different data from a scribe.

Saying it is an AI

UK GDPR's transparency principle means callers should not be misled about how their information is handled, and the ICO's AI guidance treats transparency as central. Telling callers at the start that they are speaking to an AI assistant, that the call is recorded, and how to reach a person is the simplest way to meet both expectations and avoid complaints.

Where PECR comes in

The Privacy and Electronic Communications Regulations (PECR) mainly govern electronic marketing. Answering a patient's call and booking an appointment is not marketing. If you ever use an AI agent to make outbound marketing calls, the ICO is clear that automated marketing calls need the person's specific prior consent to that type of call, and all automated calls must give your name and a contact address or freephone number.

Safety: when the AI should hand over

This is not a legal rule, but it belongs in your risk assessment. Decide which calls must go straight to a person, such as urgent clinical concerns, safeguarding, distress or complaints, and test that the agent hands them over reliably.

What Motics does

Every call answered by Phone Agent is recorded, transcribed and summarised, so you know exactly what happened on each call.
Calls transfer to your team under rules you set, such as urgent medical concerns or specific requests.
Recordings and transcripts are stored in-country by default (the UK for UK clinics) and encrypted with AES-256 at rest and TLS 1.3 in transit.
Call data is not used to train AI models, ours or any sub-processor's.
Every access to recordings is logged with who, what and when, and retention is configurable per clinic.

Full detail on our security and compliance page and the Trust Centre. Ask any vendor, including us, to put these answers in writing.

Primary sources

Practical orientation for UK clinics, not legal advice. For your own circumstances, take advice from your data protection officer, indemnity provider or a solicitor.

Can an AI phone agent record and transcribe patient calls in the UK?