Is AI sales coaching GDPR compliant?

It can be. The team using the tool needs a lawful basis (usually legitimate interest), clear notice to prospects and reps, a DPA with the vendor, a DPIA when reps are scored, and a retention period. Compliance depends on how the tool is set up as much as on the vendor.

Do you need consent to record sales calls under GDPR?

GDPR does not require consent when another lawful basis applies, and legitimate interest is the usual one for sales calls. Participants must still be informed. Some national laws add a consent requirement to record at all, so check the countries you call into.

Do you need a DPIA for AI call scoring?

In most cases, yes. Scoring reps' calls evaluates performance at work and processes employee data, two of the criteria European regulators use to flag high-risk processing. Run the DPIA before the pilot.

Can AI call scores be used in performance reviews?

They can inform a review when a manager checks the calls and weighs other factors. A decision about pay, promotion or discipline based solely on automated scores falls under GDPR article 22.

Is emotion AI allowed in sales calls under the EU AI Act?

Inferring employees' emotions at work has been prohibited since 2 February 2025, so sentiment scoring of reps is out in the EU. The Commission's guidelines place emotion recognition in customer interactions outside the ban, though other AI Act duties can still apply.

How long can you keep sales call recordings under GDPR?

As long as the purpose requires, then delete them. France's CNIL recommends 6 months at most for recordings made for staff training and 1 year for the analysis built from them. Set the period in the tool so deletion happens automatically.

AI Sales Coaching and GDPR: Compliance Checklist

Updated 15 October 2026. This guide explains the rules; it is general information and your counsel has the final word on your setup.

AI sales coaching tools are GDPR-compliant when the team using them has a lawful basis, informs everyone on the call, signs a data processing agreement with the vendor and keeps recordings only as long as coaching needs them.
AI sales coaching processes two groups of people: the prospects on the call and your own reps, whose calls get scored. Each group needs its own notice.
Scoring reps' calls counts as evaluating employees, which usually calls for a data protection impact assessment (DPIA) before rollout.
A call score can inform a rep's review; a manager makes the decision. GDPR limits decisions about people made solely by software.
The EU AI Act has banned AI that infers employees' emotions at work since 2 February 2025, so sentiment scores on reps are off the table in the EU.
The vendor checklist is short: DPA, sub-processors, hosting location, retention settings, access controls and a clear answer on model training.

European data protection authorities issued about €1.2 billion in GDPR fines in 2025, according to DLA Piper's January 2026 survey, roughly level with 2024.

Most of that money comes from large platforms. For a sales team, the practical risk sits earlier: a legal or security review that stalls the rollout, or a works council that blocks it, because nobody can explain what happens to the recordings and the scores.

AI sales coaching raises more questions than plain call recording. The software records the prospect, then scores your own rep on every call. So this guide goes through the GDPR rules that apply to each part, what the EU AI Act adds, a six-step rollout, and the questions to put to any vendor before a pilot.

Check	Rule behind it	What to do
Lawful basis	GDPR article 6	Document legitimate interest for coaching, with a balancing test
Notice to prospects	GDPR articles 13 and 14	Announce the recording at the start of the call or show a visible bot
Notice to reps	GDPR article 13	Tell reps in writing what is scored, who sees it and how long it is kept
DPIA	GDPR article 35	Run one before scoring reps' calls
Human decision	GDPR article 22	A manager reviews scores before any decision about pay, promotion or discipline
Retention	GDPR article 5	Set an automatic deletion period per call type
Vendor contract	GDPR article 28	Sign the vendor's DPA and read its sub-processor list
No emotion AI on reps	EU AI Act article 5	Switch off any feature that infers a rep's emotions

What makes AI sales coaching different from call recording

A call recorder captures the conversation. An AI sales coaching tool goes further: it transcribes the call, rates the rep against criteria such as discovery questions or next steps, and tracks those ratings over time.

That second part changes the GDPR picture. The prospect remains a data subject, as with any recording. Your rep becomes one too, and the processing now evaluates their work.

European regulators list "evaluation or scoring", including of "performance at work", as one of the criteria that make processing high risk (Article 29 Working Party DPIA guidelines). Systematic monitoring and data about employees are two more. Rep scoring often ticks all three.

If you only record calls to keep notes, read our guide on GDPR-compliant call recording. The rest of this guide covers what changes once the calls are scored.

Lawful basis: legitimate interest for most teams

Most B2B sales teams rely on legitimate interest (GDPR article 6(1)(f)): coaching reps and improving the sales process is a real business need.

Legitimate interest needs a written balancing test. Weigh what you gain from scoring calls against the rep's and the prospect's expectations, then record the safeguards you put in place: limited access, short retention, no automated decisions.

Employee consent is a weak basis. A rep cannot refuse their employer freely, so regulators rarely accept consent in an employment setting.

Some countries add their own rules on recording calls. France, for example, protects private conversations in article 226-1 of the Code pénal. Check the national law of each country your reps call into.

Transparency: tell prospects and reps

Prospects must know the call is recorded and why (GDPR article 13). The simplest practice is a visible meeting bot plus one sentence at the start of the call, with a link to your privacy notice in the invite.

Reps need more detail, because they are the ones being scored:

which calls are recorded and which are excluded
the criteria each call is scored on
who can see the recordings and the scores
how long both are kept
how scores are used in one-on-ones and reviews
how to raise an objection (GDPR article 21)

Put this in a short written policy and walk the team through it before the first scored call.

DPIA: scoring reps usually triggers one

A DPIA is required when processing is likely to result in a high risk (GDPR article 35). The regulators' guidelines say processing that meets two of their nine criteria will require one in most cases.

AI rep scoring meets at least two: evaluation of performance at work, and data about employees. Plan the DPIA before the pilot, with your DPO and the vendor's security documentation at hand.

Automated decisions: keep a human between the score and the decision

People have the right not to be subject to a decision based solely on automated processing when it significantly affects them (GDPR article 22).

The regulators' guidance gives a direct example: software that analyzes individual performance and ranks employees is caught when nobody reviews the findings before a decision (Article 29 Working Party guidelines on automated decision-making).

In practice:

Use call scores to pick which calls to review and what to coach.
Let a manager listen to the moments behind a low score before drawing a conclusion.
Keep pay, promotion and discipline decisions with a person who can change the outcome.

Retention: keep calls as long as coaching needs them

GDPR sets no fixed retention period. Recordings must be kept no longer than the purpose requires (GDPR article 5(1)(e)).

National regulators give benchmarks. France's CNIL recommends keeping recordings made for staff training for 6 months at most, and the analysis documents built from them for 1 year at most (CNIL).

Set a deletion period per call type in the tool itself. A manual clean-up rarely happens.

Processor contract: sign a DPA with the vendor

The coaching vendor processes the calls on your behalf, so you need a contract that meets GDPR article 28: instructions, confidentiality, security, sub-processors, deletion at the end of the contract.

Read the sub-processor list with care. AI tools often send transcripts to a model provider, and that provider belongs on the list.

What the EU AI Act adds

Emotion recognition on reps is banned

Since 2 February 2025, the EU AI Act prohibits AI systems that infer the emotions of a person in the workplace, apart from medical and safety uses (Future of Privacy Forum).

The European Commission's guidelines place emotion recognition used in interactions with customers outside this ban (Freshfields). A sentiment score on your rep's voice falls inside it.

Breaching a prohibited practice can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher (EU AI Act Service Desk, article 99). Ask your vendor which features infer emotions, and switch them off for reps.

Rep evaluation becomes high-risk in December 2027

AI used to monitor and evaluate workers is a high-risk use case under Annex III of the AI Act. Those obligations were due in August 2026; the Digital Omnibus on AI, in force since July 2026, moved them to 2 December 2027 (aiacto).

From that date, companies that deploy such systems take on duties such as human oversight and keeping logs. A coaching program built today with a human reviewer and clear records is already most of the way there.

Where AI sales coaching rollouts stall on privacy

The questions below come from sales and operations leaders on calls with Claap. Most rollouts stall on two things: what the prospect is told, and how reps feel about being scored.

"I keep getting some pushback from people internally that are concerned with call recording for transcripts and everything. And GDPR." (Sales leader, European IT services company)
"...we have to acknowledge their consent even before they join the meeting..." (Security reviewer, B2B software company)
"Okay, but we have to ask in every call." (Manager, B2B information company)
"We'll have no autonomy left, everything will be on file. That raises an ethical problem for us." (Manager, French B2B media group, on the objections they expect from reps; translated from French)
"They want to be sure nobody else can go and watch a colleague's video." (Sales operations lead, French B2B information group, on access between reps; translated from French)

The first three are about the prospect, and a visible bot plus a written notice answers them. The last two are about the rep. They get solved by access rules and a clear coaching policy, written down before launch.

Write down the purpose. "Coach reps on discovery and next steps" is a purpose. "Monitor the team" is too broad to defend.
Run the DPIA. List the data, the people, the risks and the safeguards. Involve your DPO and, where one exists, the works council early.
Pick the calls. Record external sales meetings and leave out internal, HR and legal meetings by default.
Set access and retention. Reps see their own calls, managers see their team, nobody else browses. Set automatic deletion per call type.
Inform everyone. Prospects through the invite and a visible bot, reps through a written policy and a team session.
Keep a human in the loop. Scores pick the calls to review and the topics to coach; managers make every decision about a person.

Questions to ask an AI sales coaching vendor

Will you sign a DPA, and where is your sub-processor list?
Where are recordings and transcripts hosted, and where does the AI model process them?
Do you or your model providers train AI models on our calls?
Can we set retention per workspace or call type, and is deletion automatic?
Can admins block recording for some teams, such as legal or HR?
Who can see a rep's scores, and can we restrict sharing?
Does any feature infer emotions or sentiment about our reps?
Do you hold an independent security report, such as SOC 2 Type II?

A quick note: Claap is our product. To keep this guide fair, we linked every major claim to its source.

Claap records and scores sales calls, and it is built for teams that need to pass a European security review:

GDPR, an independent SOC 2 Type II report, and a DPA on request with a list of sub-processors.
Calls are never used to train AI models, Claap's or anyone else's.
Teams choose a visible meeting bot, or record from the desktop app or Chrome extension and announce the recording themselves. The capture mode is set per workspace.
Admin automations decide which meetings get recorded per team, for example "never record" for Legal, and members cannot turn it back on.
Retention can be set to 3 months, 6 months, 1 year or 2 years, within the plan's storage limit: 2 years on Pro, 3 years on Business, unlimited on Enterprise.
Default link privacy is "participants only", and private spaces keep sensitive calls to the people who need them.

Claap's AI call scoring rates each call on your own criteria and places every score next to the timestamped transcript, so a manager can check the moment before acting on it. See how it fits into sales coaching software, and how recording works on the GDPR-compliant call recording page. AI coaching and admin recording and sharing controls are part of the Business plan, at $60 per seat per month billed yearly.

Relying on rep consent. Use legitimate interest with a balancing test, and inform reps.
Recording every meeting by default. Exclude internal, HR and legal meetings from the start.
Using scores as an automatic ranking. A leaderboard that drives bonuses with no human review runs into GDPR article 22.
Keeping recordings forever. Set deletion periods when you set up the tool.
Leaving sentiment features on for reps. In the EU, emotion inference about employees is prohibited.
Skipping the works council. In several countries, employee monitoring tools need consultation before launch.

Key takeaways

AI sales coaching can run under GDPR: legitimate interest, clear notice, a DPIA, a DPA and short retention cover most of the ground.
Treat the rep as a data subject. Tell them what is scored, who sees it and how it is used.
Keep a manager between the score and any decision about a person.
Switch off emotion and sentiment features for reps in the EU.
Prepare for the AI Act's high-risk duties on 2 December 2027 with human review and records you keep today.
For the US side of recording law, see our guide to one-party consent states. To build the criteria themselves, read our guide to call scoring.

AI sales coaching and GDPR: a compliance checklist

What makes AI sales coaching different from call recording