Conversational AI and data protection: where contact centre data goes

Conversational AI in a contact centre is rarely one system. A customer's words may pass through the contact centre platform, a speech recogniser, a language model, a knowledge source, a back-end system reached by a data action, and an analytics store, and each step can be run by a different company in a different place. Whether data leaves the UK, how long it is kept and whether it can improve someone's model is decided at each of those steps, not once for the whole service.

That is reassuring rather than alarming, because almost every one of those decisions is a setting or a contract term you can see and choose before go-live. Genesys documents where its own AI features process data, the major AI vendors publish their retention and training terms, and the UK regulator publishes what it expects of you. This guide follows a single conversation through each route, explains what the law asks of the organisation that deploys it, and ends with the questions worth putting to every vendor in the chain. It is general information, not legal advice; involve your data protection officer and take advice for your own circumstances.

Conversational AI processes personal data from the first word a customer says, so UK GDPR applies in full, as amended by the Data (Use and Access) Act 2025. Since 30 September 2026 the Information Commission, which replaced the Information Commissioner's Office (ICO), has regulated it; its guidance is still published on ico.org.uk. The organisation running the contact centre is the controller and stays accountable for the processing even when vendors do the work, and the regulator is clear that senior management, not only engineers, must understand the controller and processor relationships involved.

The regulator's guidance on AI says that in the vast majority of cases using AI will involve processing likely to result in a high risk to people, which triggers the legal requirement for a data protection impact assessment. Where you decide a particular use is not high risk, you must still record how you reached that view. If the assessment leaves a high risk you cannot reduce, you must consult the regulator before you start. Treat the assessment as the design document for data protection: it is where the route, region, retention and safeguards are decided and recorded.

• A data protection impact assessment, completed before the AI handles real customers
• A lawful basis for each purpose, and a condition for special category data, which callers volunteer about health and other matters
• A processor contract with every vendor in the chain, covering instructions, sub-processors, deletion and assistance
• Privacy information that tells customers AI is used, what it does with their data and who receives it
• Retention set by purpose for recordings, transcripts and bot logs, with deletion that runs on schedule
• Transfer safeguards wherever data is sent to, or can be reached from, outside the UK
• A route to a person, and safeguards for any significant decision made solely by automated means

Transparency is a core data protection principle in the UK: customers should know that an AI agent is handling their conversation, what it does with what they say, and how to reach a person. For customers in the EU, the EU AI Act adds a specific duty. Under Article 50, which has applied since 2 August 2026, providers must design AI systems that interact directly with people so those people are told they are dealing with AI, unless that is obvious, and deployers must inform people exposed to emotion recognition. A short, honest greeting usually meets both expectations without spoiling the experience.

The Data (Use and Access) Act 2025 also reformed the UK rules on decisions made solely by automated means, allowing them in wider circumstances but requiring safeguards for significant decisions: telling people, letting them make representations and contest the decision, and offering human intervention. Most conversational AI answers questions and completes simple tasks rather than making significant decisions, but an agent that can refuse a refund, a claim or credit on its own needs those safeguards designed in.

Follow one voice call. The customer's audio reaches Genesys Cloud in the region your organisation was created in, such as London. An Architect flow decides what happens next. If a native Genesys bot, Virtual Agent or agentic virtual agent handles it, the speech is transcribed and understood inside Genesys Cloud, and Genesys says most services process and store customer data within the selected region. If the flow hands the call to a third-party bot through Bot Connector or to a voice AI platform through Audio Connector, the words now also reach that vendor, in the region and under the terms of your contract with it.

Along the way the conversation leaves a trail. There is the interaction record and any recording or transcript, which stay in Genesys Cloud under the retention you set; there may be a copy of the conversation in the third-party vendor's own logs; there may be data sent to your systems by data actions; and there are analytics, such as speech and text analytics, built from the transcript. A useful exercise for the impact assessment is to draw this trail for each journey and write against every box who processes the data, where, for how long, and whether it can be used for training.

Genesys publishes which AI features may send inference to a different AWS region. Some features that use AWS Bedrock can use cross-region inference, which AWS calls CRIS, routing requests across a group of regions such as an EU profile when capacity requires. For an organisation in the London region, Genesys lists Knowledge Fabric, Agent Copilot's advanced summaries and Quality Management AI scoring as processed in London without cross-region inference. Speech and text analytics' Reason for Sentiment and AI Outline features are listed as using the EU profile, with inference in Frankfurt first, and Phrase Generation as processed in London but able to use the EU profile.

Agentic virtual agents work differently because the large action model needs GPU capacity. Genesys lists London as the default target for London organisations, with Frankfurt as an alternative, and marks mappings that cross data sovereignty borders as needing a per-organisation opt-in through Product Support. In plain terms, for a London organisation a UK-to-EU route for these features is either documented in advance or needs your agreement. Read the current tables for your own region and features when you write the impact assessment, because Genesys updates them as model availability changes.

For Genesys's own AI, Genesys says it never uses customer data for AI training or fine-tuning without the customer's consent, that its standard Master Service Agreement opts customers out of any data donation, and that customers who choose to take part do so through a controlled process in which data is sampled and fully anonymised before use. Genesys describes its models as a mix of its own machine learning models, fine-tuned open-source models trained on open-source, purchased and anonymised datasets, and foundation models delivered as a service within its data and security envelope.

Third-party services each have their own terms, and the defaults differ. Google's service terms say it will not use customer data to train or fine-tune AI models without the customer's prior permission or instruction. Amazon's documentation says its AI services, including Amazon Lex V2, may use and store customer content for service improvement, including model training and possibly in another region, unless you opt out with an AWS Organizations policy. Deepgram describes a model improvement programme and a per-request opt-out. Read each vendor's current terms for the plan you buy, and record the setting you chose in the impact assessment.

Retention is where most avoidable risk sits, because the defaults are generous. In Genesys Cloud, recordings have no fixed maximum, transcripts follow the retention set for recordings in your quality management policies, and interaction data is kept for between 90 days and five years, with no organisation-wide maximum until an administrator sets one. Genesys lists the retention for each type of data, with the ways to export it, so the schedule in your impact assessment can be checked against the platform feature by feature.

Third-party AI keeps its own copies. Dialogflow CX keeps conversation data for up to 365 days by default unless security settings set a shorter window, and applies no redaction unless an agent is given security settings. ElevenLabs keeps conversation transcripts and audio for two years by default, adjustable per agent, or not at all in Zero Retention Mode. Set every retention period from the purpose in your impact assessment, apply it in every system in the trail, and check that deletion actually happens.

UK GDPR restricts transfers of personal data to organisations outside the UK, and the regulator's guidance is clear that making data accessible from abroad counts as well as sending it. A vendor's support staff in another country who can open your conversation logs are part of the picture, as is an AI service whose logs sit in another region. Every restricted transfer needs a mechanism: UK adequacy regulations for the destination, or an appropriate safeguard such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

For US vendors, the UK-US data bridge lets UK organisations send personal data to US organisations certified to the UK Extension to the EU-US Data Privacy Framework without further safeguards. The UK government's factsheet adds a point that matters for contact centres: special category data, such as health information mentioned in a call, can be shared under the data bridge, but the UK organisation must identify it as sensitive when it is shared. Check certification for each vendor rather than assuming it, and record the mechanism for every hop in the trail.

Transcripts and bot logs collect what customers say, including card numbers, account details and health information. Genesys Cloud can automatically redact payment card data and personal information from recordings and transcripts where speech or text analytics is used, on a best-effort basis, and users granted the permission to view sensitive data can still see the originals, so that permission needs tight control. Genesys is clear that automatic redaction supplements, rather than replaces, Secure Pause and secure call flows, the methods validated for PCI DSS. Dialogflow CX can also redact with Google's Sensitive Data Protection when security settings are applied.

Conversational AI adds risks of its own: prompt injection, where a customer's words try to change the AI's instructions, and over-broad tools that let an AI agent reach more data than the task needs. Give each AI agent only the data actions and knowledge it needs, mask identifiers it does not need to see, and test with hostile and sensitive inputs before go-live. Our readiness and testing guide covers that testing in detail.

The same short set of questions works for Genesys, a bot platform, a voice AI vendor or a language model called from a data action. Ask them in writing, keep the answers with the impact assessment, and repeat them when the vendor changes a model, a region or a plan. A good vendor answers each from its documentation and contract, rather than from a sales assurance.

1. Which of our data do you receive: audio, transcripts, metadata, or data from our systems?
2. In which region is it processed, where is it stored, and can processing move to another region?
3. Is any of it used to train or improve models, and how do we switch that off?
4. How long do you keep it by default, and how do we shorten or end that?
5. Who can access it, from which countries, and under what transfer mechanism?
6. Which sub-processors handle it, and how will you tell us about changes?
7. What redaction is available, and what still reaches your logs?
8. How do you help us answer subject access and erasure requests?

We treat data protection as part of the design, not a sign-off at the end. Before an AI agent is built, our Solution Architect maps each journey's data trail with your data protection officer, choosing the route, region, retention and redaction for each step, and records the decisions in the design and in the impact assessment. We configure retention and redaction in Genesys Cloud and in any connected AI service, set the training opt-outs where a vendor offers them, and test with sensitive and hostile inputs before customers meet the agent.

We also practise what we recommend. Our own AI platform, Think, keeps customer and personal data on infrastructure we control, and we use public AI services only for work that contains none. After go-live, our managed professional services review Genesys release notes and vendors' term changes for anything that moves data to a new region or changes how it is kept, so the impact assessment stays true as the platform evolves.