Are Call Answering Services GDPR Compliant?

Every call your business receives involves personal data. A caller's name, phone number, email address and the reason they are ringing are all information that UK data protection law protects. When you ask an outside team to answer those calls, you are sharing that data with them, so it is sensible to ask how they look after it.

This guide explains how UK GDPR applies to call answering, what the law expects of you and your provider, and the practical questions to ask before you sign up. It is general information, not legal advice, so for anything specific to your business, check the guidance from the Information Commissioner's Office (ICO) or speak to a data protection adviser.

What personal data does an answering service handle?

It is easy to underestimate how much information passes through a single phone call. Depending on your business, a receptionist might note down:

• The caller's name, phone number and email address.
• Their postal address or the address of a property or job.
• The reason for the call, which can include private details about a legal matter, a health concern or their finances.
• Appointment times and booking details.

All of this is personal data. Some of it, such as health information, needs particular care. The more sensitive your callers' enquiries, the more closely you should look at how your provider handles them.

Controller and processor: who is responsible?

UK GDPR splits responsibility between two roles. When a business uses a call answering service, the business is normally the controller and the answering service is its processor.

• The controller (you) decides why and how personal data is used. You decide what information receptionists collect and what happens to it.
• The processor (the answering service) handles that data on your behalf and should only process it in line with your instructions.

This matters because being the controller means the responsibility does not disappear when you outsource. You need to choose a provider that can protect your callers' data, and you need the right paperwork in place.

What your contract with an answering service must include

According to the ICO, Article 28(3) of UK GDPR requires a written contract between a controller and a processor. It should set out the subject matter and duration of the processing, its nature and purpose, the type of personal data and categories of people involved, and the controller's obligations and rights.

The ICO also lists minimum terms the contract must cover. The processor must:

1. Process personal data only on the controller's documented instructions.
2. Make sure the people handling the data are under a duty of confidence.
3. Take appropriate security measures.
4. Follow agreed rules on using sub-processors.
5. Help the controller respond to data subjects exercising their rights.
6. Assist the controller in meeting its other obligations.
7. Delete or return the data at the end of the contract.
8. Allow audits and inspections.

If a provider cannot show you a data processing agreement covering these points, treat that as a warning sign.

Questions to ask a call answering provider about data

A contract is the starting point, but the day-to-day detail matters too. These questions help you understand how a provider works in practice:

For a wider checklist covering pricing, scripting and contracts, see our guide on questions to ask before choosing a call answering service, and our earlier article on how to choose a virtual receptionist service.

Your side of the arrangement

As the controller, there are a few practical steps you can take to keep things tidy:

• Only ask for what you need. When you brief your answering service, think about which caller details you actually use. Our guide to what information receptionists need helps you plan this.
• Give clear, written instructions. A processor acts on your documented instructions, so put your call handling rules in writing.
• Think about how messages reach you. Decide who in your team receives call summaries, and whether email, SMS or an online portal suits you best. Our article on how you will receive your messages explains the usual options.
• Take extra care in sensitive sectors. Accountants, financial advisers, law firms and clinics often handle especially private enquiries, so it is worth checking the detail closely. See our call handling for finance firms and accountants.

How Onwards Answering handles your callers' data

Our privacy policy sets out how we work. We operate under UK GDPR and the Data Protection Act. We act as a data controller for our own operations and as a data processor when we handle data on behalf of our clients, processing it only in line with client instructions.

Call data and messages are retained in line with client agreements. We use secure systems with restricted access, and our staff are trained on confidentiality and data protection. Our receptionists are based in Scotland, working from home rather than in a call centre, and are supported by team leads and client managers.

If you have questions about how we would handle data for your business, ask us before you start. We would rather you check than assume.

Talk to Onwards Answering about your calls

Our outsourced call handling service answers calls in your company name, takes detailed messages and sends you a call summary after every call. You can try it with a free 2 week trial, then prices start from £72 per month, with no per-call charges.

See our prices and plans, or contact our Glasgow team with any data protection questions before you begin.

Frequently asked questions