GDPR and AI Voice Calls: What Brokerage Teams Should Review

An AI voice agent that rings a dormant trader in Frankfurt touches that trader's personal data at least six times before the CRM note is saved. For brokers, GDPR and AI voice calls meet at every one of those points: the list export, the dial, the recording, the transcript, the automated summary and the write-back. Most of the rules are ones your retention desk already lives under. A few are new, and one transparency duty from the EU AI Act only started applying on 2 August 2026.

This review walks a brokerage compliance desk through the questions a DPO will ask before launch. Lawful basis, what the agent says, whether a DPIA is needed, who handles the audio, how long recordings live, and what a trader can demand afterwards. Each point maps to an article of the regulation you can cite in the campaign file.

Key Takeaways

• GDPR Article 21 gives every trader the right to object to direct marketing at any time, and that right has to be mentioned at the first contact.
• Article 35 requires a DPIA before processing that uses new technologies and is likely to carry a high risk, which covers most brokerage AI calling programs.
• Since 2 August 2026, EU AI Act Article 50 requires AI systems that talk to people to be built so the person knows it's an AI.
• A subject access request gets one month under Article 12(3), and the recording, transcript and AI summary all count as the trader's data.
• Serious GDPR infringements carry fines up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
• Topcalls includes recording and transcription in its $0.35 per minute price, so the retention decision is about policy, not add-on cost.

1. Which lawful basis covers an AI voice call to a trader?

The lawful basis depends on the segment, not the technology. A funded client who traded last month can usually be called under legitimate interests or the account agreement. A trader who last logged into MT4 three years ago often can't, and a registered-never-funded lead needs whatever consent was captured at sign-up. Write the basis down per segment before the list leaves the CRM, because an AI agent can't repair a basis that was never there.

GDPR is only the first layer. The ePrivacy rules and each country's marketing-call law sit on top, and some member states require prior opt-in for marketing calls to consumers. The UK adds PECR and TPS screening, covered in our UK PECR compliance guide. Check the national rule for every country on the list as well as the country where the brokerage is licensed.

What the agent says on the call needs a basis too. Reading a trader's last deposit amount or open-position count back to them is processing that data for marketing. Keep the call payload to what the segment's basis covers, and keep KYC documents out of the calling platform entirely.

• Consent: pull the record for every segment that relies on it: date, wording, form and whether phone marketing was named. A newsletter tick box from 2021 rarely covers an AI call in 2026.
• Legitimate interests: complete the three-part assessment per segment and file it with the campaign. Dormant traders who were told at onboarding that the broker may call about their account are the strongest case.
• Contract: covers service calls such as a KYC document reminder or a pending withdrawal, not a deposit-bonus pitch. Don't stretch it.

The consent side deserves its own read: marketing consent for dormant trader outreach goes segment by segment.

2. What must the AI agent say at the start of the call?

Four things in the first fifteen seconds: who's calling, why, that an AI agent is handling the call, and that it's recorded and transcribed. Article 21(4) also requires the right to object to be "explicitly brought to the attention of the data subject" at the latest at the first communication, presented separately from other information. That's a sentence in the opening script, not a link in a privacy notice nobody opens.

The AI disclosure is now law across the EU. Article 50(1) of the AI Act requires systems that interact directly with people to be "designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system", and that obligation applies from 2 August 2026. A brokerage deploying the agent shares the exposure with the vendor, so put the disclosure in your own script rather than trusting a default.

Language matters here. A disclosure the trader doesn't understand isn't a disclosure. Topcalls runs campaigns in 32 languages, so a Polish trader on a Cyprus broker's list hears the AI notice and the recording notice in Polish, in the same opening line the compliance desk approved. The full wording question is covered in AI call disclosure: questions brokers should address.

Update the privacy notice too. It has to cover automated calls, call recording, transcription and any AI processing of the audio, with a version date. Then give the trader one plain way to reach it: a URL read out, or an SMS sent after the call.

The GDPR Review Checklist for AI Voice Calls turns this review into 48 line items you tick off with your DPO: lawful basis, transparency, DPIA, processors, retention, rights and security controls.

3. Does a brokerage need a DPIA before AI voice calls?

Run the screening every time, and expect the answer to be yes for most reactivation programs. Article 35(1) requires a DPIA where processing "in particular using new technologies" is "likely to result in a high risk to the rights and freedoms of natural persons". An agent that records voice, transcribes it, scores intent and writes to the CRM ticks the new-technology box and handles financial data. Supervisory authorities treat that combination as high risk.

The DPIA describes the flow end to end and names every category of personal data on the call: name, phone, account status, deposit history, the trader's voice, and anything the trader volunteers. Six steps is the usual shape.

Watch one line in particular. Article 35(3)(a) names automated evaluation "on which decisions are based that produce legal effects" or similarly significant effects. Design the campaign so the agent never makes such a decision on its own. Flagging an account for a human retention manager is fine. Closing it, changing margin terms or blocking a withdrawal is not something an AI call should trigger.

4. Who processes the audio, and where does it go?

Your AI voice vendor is a processor under Article 28, and every telephony, speech-to-text, text-to-speech, language-model and hosting supplier behind it is a sub-processor. Article 28(2) says a processor "shall not engage another processor without prior specific or general written authorisation of the controller". So the first document to request isn't the security whitepaper. It's the sub-processor list with a country against each name.

Map every transfer outside the EU or UK and record the mechanism: adequacy decision, standard contractual clauses or another approved route. Then settle what the vendor may do with the audio beyond your campaign. If your policy excludes model training on customer calls, get that exclusion in the DPA, in writing, before the first dial.

Bundled pricing simplifies the review. Topcalls charges $0.35 per minute all-inclusive, covering the voice model, telephony, recording, transcription and analytics, so the compliance desk reviews one contract chain instead of stitching five vendors together. The platform's compliance posture covers GDPR alongside TCPA, TSR and DNC. The controls are described on the secure infrastructure page; the sub-processor list is still yours to request and file.

Access control belongs in the same section. Restrict recordings, transcripts and the lead list to named roles, and review the user list in the calling platform before launch. A retention manager who left in March shouldn't still have a login in September.

5. How long should a broker keep AI call recordings?

As long as the purpose needs and not a day longer, with a separate clock for recordings, transcripts and AI summaries. Marketing calls and regulated calls follow different rules. A reactivation call that turns into a discussion of a specific order may fall under MiFID II record-keeping; a plain "are you still trading" call doesn't. Store the two classes separately and set the deletion date in every tool the transcript was pushed to.

The uploaded lead list needs its own line in the schedule. Define what happens to it when the campaign closes: deleted from the calling platform, and the date it happened. The same goes for the copy your marketing agency kept.

Cost shouldn't drive the retention decision, and with Topcalls it doesn't have to. Recording and transcription sit inside the $0.35 per minute price, so keeping a transcript for 90 days or 30 doesn't change the invoice. The full schedule, class by class, is in data retention for brokerage AI voice campaigns.

6. How do traders exercise their rights after an AI call?

The same way they do after a human call, and the deadline is the same. Article 12(3) gives you one month to act on an access, erasure, rectification or objection request, extendable by two further months for complex cases. What changes is the scope. A subject access request now covers the recording, the transcript, the AI summary and any intent score, held at the vendor and in every tool the outcome reached.

Objections raised on the call are the case most brokers miss. Under Article 21(3), once a trader objects to direct marketing "the personal data shall no longer be processed for such purposes". So "stop calling me" spoken to an AI agent is a suppression event, not a call outcome. The agent has to capture it, the CRM has to flag it, and the next campaign has to screen against it. Do-not-call screening for forex campaigns shows the mechanics.

Rectification comes up more than you'd expect. An agent that greets a trader by the wrong name, or quotes a balance from a stale export, has created inaccurate data. Fix the CRM record within the month, and check the export process so the next customer reactivation campaign starts from clean data.

Third-party data is the wrinkle in access requests. A recording may contain a spouse's voice in the background or a colleague's name. Someone has to review before release, and that reviewer needs to be named in the process.

7. What does getting GDPR wrong cost a broker?

Article 83(5) caps fines for serious infringements, including lawful-basis and data-subject-rights failures, at "20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover". Lesser infringements under Article 83(4), such as processor and DPIA failures, reach EUR 10 million or 2%. A breach starts a clock: Article 33(1) requires notifying the supervisory authority "not later than 72 hours after having become aware of it".

Compare that with the campaign itself. At $0.35 per minute, a four-minute reactivation call costs $1.40, and a program that reaches 5,000 dormant traders comes to about $7,000 in calling cost. The GDPR review is a day of DPO time. Skipping it to save that day is the worst trade on the desk. Put your own list size and reactivation rate into the dormant trader revenue calculator to see what a compliant program returns.

If you'd rather walk through the six areas with someone who has set them up for other brokers, book a 30-minute call. You'll get a proposal within 48 hours of the strategy call, and a live campaign takes around two weeks.

8. When this doesn't fit

An AI voice campaign isn't the right tool for every segment, and GDPR is often the reason. Four situations where the honest answer is to hold off.

• No usable lawful basis for the segment. If the consent record is a 2019 newsletter tick box and the legitimate interests assessment doesn't hold up, don't dial. Fix consent capture at onboarding first.
• Every call carries a regulated decision. Margin calls, complaints handling and anything that ends in an account action belong with a licensed human, not an AI agent.
• The vendor can't produce a DPA and a sub-processor list. No list means no Article 28 compliance, whatever the demo looked like.
• The list is tiny. For 150 traders in one country, a DPIA and a processor review cost more than the campaign. Have a retention manager call them by hand.

For a broader compliance view that goes beyond GDPR, our AI outbound calling and GDPR guide covers the general case beyond brokerage, including the ePrivacy layer and the UK position.

Six areas, one file, signed off by the DPO before the first dormant trader hears the phone ring. That's the whole review. The checklist below gives you the line items.