Data protection and AI voice: what Swiss law actually requires

Two questions come up in almost every conversation about an AI phone assistant: is it legal, and what happens to the data? The short answer is yes, under conditions any small business can meet.

Here is what Swiss law actually asks of you, with a link to each text. It is not legal advice: for a specific case, and above all in healthcare, ask a specialist.

The law already covers AI

The Federal Act on Data Protection (FADP) says nothing specific about artificial intelligence, and that is deliberate. The Federal Data Protection Commissioner said so plainly:

In other words, the rules that apply to your customer file already apply to your phone assistant.

No consent, but you must inform

Unlike the European GDPR, the Swiss law does not require consent for every use of personal data. You need a justification only in three cases: you break the basic principles, the person has expressly objected, or you pass sensitive data to a third party (art. 30 and 31).

What you do have to do is inform (art. 19): who you are, why you collect the data, and who receives it, including the country if it goes abroad. In practice: a sentence in your greeting and an up-to-date privacy page.

Health data is sensitive data, so a medical practice is in the third case above. Our article for medical practices covers what that changes.

Recording: where the real risk is

Recording a phone call is a matter for the Criminal Code, not just data protection. Art. 179ter makes it an offence to record a non-public conversation without the other person’s consent.

There is an exception for business calls such as orders and reservations, but the Commissioner sets out its limits: only for high-volume, routine calls, never for complaints, and only as evidence, not for quality control or training.

The simple, solid answer is not to keep the audio at all. That is Voko’s default: the audio of a call is not recorded, and a written summary does the job. Recording only runs if you switch it on, and the assistant then announces it at the start of the call.

Can the data leave Switzerland?

Yes. The law does not require Swiss hosting. It requires you to know where the data goes, and on what basis (art. 16 and 17):

• To a country with adequate protection, on the list in annex 1 to the ordinance. Every EU and EEA country is on it.
• To the United States, only to companies certified under the Swiss-U.S. Data Privacy Framework, or with standard contractual clauses.

So ask each provider three things: where the database is, where the voice is processed, and which company carries the phone call. Our answers, provider by provider, are on our privacy page.

Five things you may have read

On fines: the Commissioner orders measures, such as stopping a processing operation. Fines come from the cantonal authorities, for intentional breaches only. For a small business, the real risk is being told to stop using a service your phone depends on.

What to do, in order

1. 1
   Say who you are in your greeting

   The name of the business, and that an assistant is answering for you.

2. 2
   Do not record the audio

   A summary is enough to run your phone. With Voko, the audio is not recorded by default: leave recording off.

3. 3
   Write down where the data goes

   Three lines on your privacy page: database, voice, phone line, with the country of each.

4. 4
   Have the provider act on your instructions

   The law calls it a processing agreement (art. 9). Voko’s terms cover it: your callers’ data is processed only on your instructions, never to train models.

5. 5
   Keep data only as long as needed

   At Voko, the caller’s number and the summary are erased after 30 days by default, or after the delay you choose.

None of this is specific to AI: an outsourced answering service carries the same duties. For how the assistant itself works, read how an AI phone assistant works. And to hear it, enter your website: in under a minute, an assistant that knows your services and opening hours answers you.