AI agents, GDPR and call recording: the rules for a business in Greece

What are the rules on recording calls in Greece?

The starting point is the confidentiality of communications. Article 4(3) of Law 3471/2006 allows calls to be recorded in the course of lawful business practice, to provide evidence of a commercial transaction or other business communication.

According to the Hellenic DPA, this exception is read narrowly: recording is permitted when necessary to prove that a specific conversation took place and had specific content, not for every business communication in general. The law speaks of consent after notice, while the Authority says that where recording is lawful, prior notice to the party who did not initiate it is enough, and that a recorded message before the conversation can provide it.

The familiar "this call is recorded for quality purposes" is not in itself a safe legal basis in Greece. Define a specific purpose for each call flow and ask your legal adviser or DPO.

Transcripts and summaries also need care. Even without audio they contain personal data and the GDPR applies. Whether and how Article 4(3) applies to an AI agent's transcripts is a point your legal adviser should review for your own use.

What did the AI Act change on 2 August 2026?

Article 50 of the AI Act says that systems interacting directly with people must be designed so that people are told they are dealing with AI, unless that is obvious. The notice must be clear and given at the latest at the first interaction.

According to analysis by Baker Botts, these obligations became enforceable on 2 August 2026 and Regulation (EU) 2026/1744 (the Omnibus) did not move that date, although it did push high-risk system requirements back to December 2027. Fines reach €15 million or 3% of worldwide turnover.

The Article 50(1) duty formally falls on the provider of the system. In practice vendor contracts usually leave its wording to the customer, and the sentence is heard on your line, so check that it exists and was not removed when the greeting was customised. For example:

"Hello, I am the clinic's digital assistant, an artificial intelligence system. I can book or change your appointment, or connect you to reception. How can I help?"

What does GDPR require and who is responsible?

In the usual arrangement your business is the controller and the agent's vendor the processor. Your business decides the purpose and informs customers. The essentials are:

• A data processing agreement (GDPR Article 28) with the vendor, clear about subprocessors and storage location.
• Notice (GDPR Article 13): who processes the data, why, for how long and with what rights. Your privacy policy must mention the agent.
• Retention: set a specific period for recordings and transcripts, not "as long as needed".
• Minimisation: the agent only asks for what the job needs.
• Impact assessment (DPIA): assess whether one is needed, especially for high call volumes or health data.

Clinics need particular care, because health data is a special category under GDPR Article 9. Design the agent to book the appointment without asking for symptoms and to pass anything about health to a person.

Which rule applies to outbound calls?

Article 11 of Law 3471/2006 says automated calls for direct marketing are allowed only with prior explicit consent. In decision 56/2021 the Hellenic DPA fined a company €30,000 that could not prove consent, stressing that the rule applies even if the number is not on the register of people who refuse such calls.

So an agent calling a list to promote products needs explicit consent from each recipient, with proof. An appointment reminder to an existing customer is a different case, but its content must stay purely informative.

What should you check before you open the line?

1. The greeting says the person is talking to an AI system.
2. Recording is off, unless you have a specific written purpose.
3. If it is on, the notice plays before the conversation and states the purpose.
4. You have set retention periods for audio, transcripts and summaries.
5. A data processing agreement with the vendor is signed.
6. Your privacy policy mentions the agent and the vendor or its category.
7. The agent hands over to a person easily and asks for no unnecessary details.
8. It makes no outbound marketing calls without provable explicit consent.
9. Order or appointment details are only given after identity is confirmed.
10. Your legal adviser or DPO has seen the flow.

At HiNewton recording is optional and switched on per agent, with notice to the caller before the conversation, primary hosting is inside the EU, some AI providers may process data outside the EEA under GDPR safeguards, and we act as processor. The purpose and legal basis remain your business's decision.

This text is general information based on the sources listed, as of 31 October 2026, and is not legal advice.