Glossary

UK GDPR

UK GDPR is the UK's main data-protection law, with the Data Protection Act 2018. It governs how businesses collect, use, store and transfer personal data.

All terms

Definition

UK GDPR is the version of the EU General Data Protection Regulation kept in UK law after Brexit, read together with the Data Protection Act 2018 and enforced by the Information Commissioner's Office (ICO). It applies to personal data such as names, phone numbers, call recordings and transcripts. A business using an AI agent needs a lawful basis for the data, must tell people how it is used, keep it no longer than needed, keep it secure, and protect it when it is transferred outside the UK.

UK GDPRGlossary

1AI voice agents in the UK

2PECR (UK)

3PII (Personally Identifiable Information)

What it means for AI voice and chat agents

Transparency: tell callers and chat users who you are, what you record and why — the agent's greeting is a natural place to start.
Lawful basis: have a lawful basis for processing, such as consent or legitimate interests, and for marketing also follow PECR.
Minimisation and retention: record only what you need and delete it when you no longer need it.
Transfers: personal data sent outside the UK needs safeguards.

Where ThinnestAI stores and processes data

International workspaces store their data in London. Calls are processed partly outside the UK — speech recognition in the EU, and the voice and language model in the US — under UK transfer safeguards. India workspaces store their data in Mumbai. See the privacy policy for details.

Your responsibilities

As the business deploying the agent, you are responsible for your lawful basis, privacy notices and answering people's data requests. ThinnestAI gives you tools such as call recording that is off until you switch it on, and a do-not-contact list. This is general information, not legal advice.