GDPR-Compliant AI Teammate: EU Data Residency, DPA, Article 22

Why Are Most “GDPR-Compliant” AI Agents Only Conditionally Compliant?

The GDPR was published in 2016 and applied from May 2018 (Regulation 2016/679, EUR-Lex). Almost every AI agent vendor selling into Europe today claims to be GDPR-compliant. The claim varies in substance.

EU region availability is not the same as EU residency by default. Most US-built AI agent platforms offer an EU storage region - on the enterprise plan. Self-serve and mid-market customers often default to US regions and have to negotiate EU residency as a contractual addendum. The European Commission's legal framework on EU data protection makes clear this is a meaningful legal distinction.

A “GDPR-ready” claim is not the same as a signed Data Processing Agreement. GDPR Article 28 requires controllers (the customer) and processors (the AI vendor) to have a written DPA covering the scope of processing, sub-processors, security measures, and termination. Some vendors will sign one; some will not.

Sub-processor disclosure is uneven. GDPR requires processors to disclose their own sub-processors and obtain controller authorisation. Some AI agent vendors disclose; some do not.

Model training on customer data is the silent default at many vendors. Unless the vendor explicitly contracts that customer conversations will not be used to train any model, the default is often that they will.

Automated decisioning under Article 22 is rarely addressed concretely. GDPR Article 22 limits decisions made solely by automated processing that produce legal or similarly significant effects. Most AI agent vendors do not discuss it on their marketing pages. See the Article 22 navigable summary on GDPR.eu for the regulatory text.

What Does GDPR Compliance Actually Require for Voice AI?

GDPR is a long regulation. For AI voice and ops agents specifically, five articles dominate the practical picture. Detailed guidance is published by the European Data Protection Board (EDPB guidelines index).

Article 6 - lawful basis. Every processing activity needs a documented lawful basis: consent, contract, legal obligation, vital interest, public interest, or legitimate interest. For an AI agent taking a customer call to handle a service request, “performance of a contract” is typically the basis; for outbound calls, consent or legitimate interest with a documented balancing test.

Article 22 - automated decision-making. A data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects. Voice agents that screen, schedule, summarise, and escalate to humans do not trigger Article 22 for the screening itself, because the binding decision stays with a human. The vendor must support that human-in-the-loop pattern; the customer must use it.

Article 28 - processor obligations. A signed Data Processing Agreement covering processing scope, security measures, sub-processors, sub-processor change notification, audit rights, and return-or-deletion at termination.

Article 32 - security of processing. Encryption in transit and at rest, access controls, periodic testing.

Article 44 onward - international transfers. Personal data leaving the EEA needs a transfer mechanism: adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules. The cleanest answer for a European AI agent is: do not transfer. Keep the data in the EU.

How Is Ainora GDPR-Compliant by Design?