GDPR: call recording vs AI roleplay

This is an overview, not legal advice. It rests on the text of GDPR, IMY's criteria for impact assessments, two Swedish enforcement decisions on recorded calls and the European Data Protection Board's opinion on AI models. If you have read our article on recording sales calls you know that the Swedish Criminal Code lets a participant record the call, and that GDPR applies anyway the moment the company stores and analyses it. Here we pick up where that article stops.

Track one: the customer's personal data

A recorded voice is personal data and recording it is processing, under Article 4 of GDPR. The purpose 'train our reps' needs a legal basis, and this is where Swedish enforcement has been clearest. Datainspektionen, now IMY, found in its decision on Tele2 of 10 May 2016 that the company lacked legal support for recording customer service calls for the purpose of training staff, quality-assuring their development and improving how customers were received, and that customers had not been given sufficient information. The decision was made under the old Personal Data Act, but the balancing it describes is the one GDPR requires: the interest must be legitimate and outweigh the data subject's interest in protection.

Then come the duties that travel with every customer in the material. Information no later than at the recording, under Articles 13 and 14. Deletion when the training purpose is met, under Article 5(1)(e). And access requests: IMY's own FAQ says everyone has the right to obtain recordings of their voice, and in a call between two people the parts where their own voice is heard. Each such request is a search-and-redact job in your archive. The Swedish contact-centre association Kontakta's ethical principles go further than the law and say recording in telephone sales may only start after the customer's active consent.

The storage itself carries a risk of its own. On 7 June 2021 IMY ordered Voice Integrate Nordic AB to pay SEK 650,000 for a breach of Article 32(1), after audio files of recorded calls to the 1177 health line had been left accessible on the internet with no protection. An archive of customer calls is an attack surface, and every call you keep for training makes it bigger.

Track two: the employee's personal data

This is the track most often forgotten. Recording every call a rep makes, letting a tool analyse it and tying the result to a name is monitoring of employees. IMY's list of when an impact assessment is required has nine criteria, and the main rule is that the assessment must be done when at least two are met. Systematic monitoring of people is criterion three. Data about people in a dependent position, where IMY explicitly names employees, is criterion seven. New technology is criterion eight. Recording with AI analysis of every customer call hits all three. Under Article 35(7) the assessment must contain a description of the processing, a test of necessity and proportionality, a risk assessment and the measures you intend to take, and it must be reviewed when the risk changes.

That is a document that takes days to do properly, that needs to be discussed with the union where there is a collective agreement, and that has to be updated every time the tool gets a new feature. None of that is a reason to skip it. It is simply a cost to plan for.

Track three: the vendor and the AI model

The tool that transcribes and analyses is a processor, and Article 28 requires a contract governing what it may do. The new question in 2025 and 2026 is what happens when the vendor trains its model on your calls. On 17 December 2024 the European Data Protection Board adopted Opinion 28/2024 on AI models, which covers when a model can be considered anonymous, how the legitimate interest assessment works in the development and deployment phases, and what happens to a model trained on unlawfully processed data. As a customer, that leaves you with one concrete question for the vendor: are our recordings used to train your model, and if so on what legal basis? 'It is in the terms' is not an answer.

The same three tracks for AI roleplay

A roleplay against an AI buyer contains no customer. There is no third party to inform under Article 14, no consent to ask for before the recording starts, no customer access requests, no deletion schedule for customer audio and no archive of real calls that can end up online. Track one disappears. That is not a legal trick, it follows from Recital 26 of GDPR: the principles do not apply to information that does not relate to an identifiable person, and an invented head of procurement is not a person.

Track two still applies, just on a smaller scale. The rep's own voice and transcript are personal data about an employee. The employer needs a legal basis, must tell the rep what is stored and how the scores are used, and should think through whether the scores feed pay reviews or only coaching. The difference from track two above is scope: one user choosing to practise on an invented scenario, instead of systematic recording of every real call with every customer. Track three also remains: the roleplay vendor is a processor and needs an Article 28 agreement, and the same question about model training has to be asked.

The comparison, point by point

• Legal basis for customer data: required, and the Tele2 decision shows how hard a training purpose is to justify. AI roleplay: no customer data.
• Information to the customer: no later than at the recording, Articles 13 and 14. AI roleplay: no customer to inform.
• Access requests and deletion: every customer in the archive can request their voice, and everything must go when the purpose is met. AI roleplay: only the rep's own calls.
• Impact assessment: normally required, three of IMY's criteria are hit. AI roleplay: still assess it, but the processing is voluntary practice on a small scale.
• Processor agreement: required for both. The model-training question: asked of both.
• Attack surface: an archive of real customer calls. AI roleplay: practice calls with no customers in them.

What it means for the choice of training

Recorded customer calls have a value AI roleplay cannot replace: they show what real customers actually say. Our comparison of conversation intelligence and AI roleplay covers the teaching side. The legal side says something simpler. If the aim is for a rep to practise one moment many times and get feedback on every attempt, it is hard to justify processing thousands of customers' data for it when the same practice can be done without a single customer in the material. The necessity test in the EDPB's guidelines on legitimate interest is exactly that question: can the interest be achieved just as well with less intrusive means?

In Salesprep the rep practises cold calls, follow-ups, reschedules, pitches, presentations and negotiations against an AI buyer that plays from a scenario, and every call is scored on six or seven metrics from a library of ten, with a written comment per score. The only call stored is the rep's own practice call. Cold call is in every plan with three free calls, no card required. Follow-up and Reschedule are available on Pro and up, and Pitch, Presentation and Negotiation on Team Pro.