A client calls your law firm at 7pm on a Tuesday. No one answers. They hang up and call the next firm on the list. That client — who might have brought a significant matter — is gone before you even knew they called.
This is not a hypothetical. It is what happens in every small law firm that does not have after-hours call coverage. And it is entirely preventable.
AI phone receptionists solve this problem. But law firms have legitimate questions that a dental clinic or beauty salon does not. Client privilege. Special category data. Professional liability. GDPR compliance. These are real concerns — and they have real answers.
This guide is written for lawyers and practice managers at Polish kancelarie who are evaluating AI reception solutions and need to understand the legal and compliance picture before switching.
The Real Risk: Missed Calls, Not AI
Before we discuss GDPR, let us establish the baseline risk you are already accepting.
When a potential client calls during a court hearing and no one answers, you have lost them. When an existing client calls on a Friday evening about an urgent matter and reaches voicemail, they feel abandoned. When overflow calls during peak hours go unanswered for three minutes and the caller hangs up — that is a client relationship damaged.
The financial cost is straightforward: one missed new client consultation, at 300–500 PLN, covers the monthly cost of an AI receptionist for many practices. The reputational cost — a client who felt their call did not matter — is harder to quantify.
Against this, the GDPR compliance question is real but manageable. Let us work through it clearly.
Does Legal Privilege Extend to AI-Processed Calls?
This is the first question most lawyers ask, and it is a good one.
The short answer: AI does not "know" the content is privileged. It processes audio, transcribes words, and routes the call. It does not retain the substance of legal matters, cannot be deposed, and does not hold a professional relationship with your client.
Legal professional privilege protects communications between a lawyer and their client from compelled disclosure to third parties, including courts and regulators. The critical question is not whether an AI heard the call — it is who has access to the data after the call.
Under ZvonAI's architecture:
- Transcripts are stored in your account, accessible only to authorised staff at your firm
- ZvonAI does not read your call content for any purpose other than technical operation
- Call data is not used to train AI models
- Transcripts are deleted after 90 days by default (configurable to shorter periods)
- ZvonAI staff do not have routine access to call content — only for contracted support, auditable
This is materially similar to using a cloud-based case management system: the SaaS provider has technical access to the infrastructure, but the data belongs to your firm and is protected by a Data Processing Agreement.
If your firm already uses cloud-based document management, email, or a client portal — the privilege analysis for AI reception is not materially different.
Special Category Data in a Law Firm Context
GDPR Article 9 defines "special category data" as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation, and data relating to criminal convictions.
Law firms encounter special category data constantly:
- A client mentions a medical condition relevant to a personal injury claim
- A caller describes a domestic situation involving children
- A client in a criminal matter discusses their charges or record
- An employment dispute involves a colleague's health or disability
Does this mean you cannot use AI for call handling? No. It means you need a lawful basis for processing that data.
Lawful Bases for Special Category Data in Calls
For a law firm receiving calls, the applicable basis under Art. 9(2) is typically:
- Art. 9(2)(f): Processing is necessary for the establishment, exercise, or defence of legal claims
- Art. 9(2)(h): Processing is necessary for the provision of professional services (health professionals and equivalent — arguable for legal advice in some contexts)
- Art. 9(2)(a): Explicit consent — the caller has been informed that AI is handling the call and consented to the recording/transcription
ZvonAI's call handling includes a DTMF consent gate: at the start of every call, the AI identifies itself and informs the caller that the conversation may be transcribed for quality and service purposes. The caller can opt out of transcription by pressing a key, in which case the AI still takes the call but does not produce a written record.
This consent mechanism is designed specifically for environments where special category data may arise.
What GDPR Requires from Your AI Provider
Before signing up with any AI phone receptionist service, your firm needs to confirm three things.
1. A Signed Data Processing Agreement (Art. 28 GDPR)
Any company that processes personal data on your behalf is a "data processor" under GDPR. You must have a written contract — a Data Processing Agreement (DPA) — that:
- Specifies the subject matter and duration of processing
- Lists the types of personal data and categories of data subjects
- Names all sub-processors (third parties the processor uses)
- Includes rights to audit the processor's compliance
- Specifies deletion timelines and procedures
- Includes appropriate EU/EEA data transfer mechanisms if data leaves Europe
ZvonAI provides a standard DPA as part of every subscription. For law firms with specific requirements, a customised DPA review is available — contact dpo@zvonai.ai to request the law firm template.
2. EU-Based Infrastructure or Appropriate Transfer Safeguards
GDPR restricts transfers of personal data outside the EU/EEA unless appropriate safeguards are in place. ZvonAI operates on Google Cloud Platform with primary data storage in the EU (Frankfurt and Warsaw regions).
For the voice transcription component (Deepgram), data is processed in real time and not retained — and Standard Contractual Clauses (SCCs, Commission Decision 2021/914) are in place. Transfer Impact Assessments have been completed for each US-based sub-processor. The data involved is technical audio signal, not the client's personal details or legal matter content.
3. Transparency to Callers
GDPR requires that individuals whose data is processed are informed. For incoming calls handled by AI, this means:
- The caller is told they are speaking with an AI (also required under EU AI Act Art. 50, in force since February 2026)
- The caller is informed that the call may be recorded or transcribed
- The caller has a meaningful way to opt out or speak to a human
ZvonAI's default scripts meet all three requirements. Your firm can customise the opening message, but the core disclosure elements cannot be removed — this is by design.
What a Law Firm DPA with ZvonAI Covers
The ZvonAI DPA for law firms includes specific provisions relevant to legal practices:
Sub-processors disclosed: Deepgram (STT, US, SCC), ElevenLabs (TTS, US, SCC), Google Cloud (infrastructure, EU), Twilio (telephony, US, SCC). The list is updated when sub-processors change; you are notified in advance.
Right to audit: Your firm has the right to request ZvonAI's compliance documentation, including security certifications, sub-processor agreements, and transfer impact assessments. Audit rights are exercisable with 30 days' notice.
Deletion timeline: Call transcripts deleted after 90 days. Call metadata (date, duration, number) deleted after 12 months. You can request earlier deletion at any time via the dashboard or by contacting support.
Breach notification: ZvonAI will notify you of any personal data breach affecting your clients' data within 72 hours of becoming aware of it — matching the GDPR notification window.
No AI training on your data: Your call data is not used to improve, train, or fine-tune any AI model. This is contractually guaranteed.
Practical Setup for Law Firm Use
The key to compliant AI reception in a law firm is scope control. The AI should handle a defined set of call types and escalate everything else to a human.
What the AI handles well
- Greeting callers and collecting name and contact number
- Booking consultation appointments in available calendar slots
- Providing basic information: office hours, address, practice areas (general level only)
- Taking messages for specific lawyers with callback promise
- Handling overflow during court hours
What the AI must never do
- Offer any opinion on the merits or prospects of a legal matter
- Provide information that could be construed as legal advice
- Make commitments about outcomes, costs, or timelines
- Handle emotionally distressed callers without immediate escalation
ZvonAI scripts are pre-configured for law firms with deflection phrases for every scenario where legal judgment would be required: "I am not able to advise on your matter — but I can make sure a lawyer calls you back today." These deflections are mandatory and cannot be removed by the law firm administrator.
The Business Case in Numbers
Polish kancelarie using ZvonAI as second-line handling — after-hours, weekends, overflow — report the following:
- Calls answered outside business hours: up from near zero to 100%
- New client consultations booked without human intervention: 40–60% of after-hours calls
- Time saved per week for administrative staff: 3–5 hours (calls that previously required callbacks)
The cost of ZvonAI for a small law firm is a fraction of a single missed consultation fee. The compliance overhead — signing a DPA, adding one entry to your Records of Processing Activities — takes one afternoon.
The alternative is continuing to lose clients who called at 6:30pm and didn't leave a voicemail.
ZvonAI in Polish Law Firms Today
ZvonAI is already in use by Polish kancelarie as second-line call handling for after-hours, weekends, and high-volume periods. The setup is designed for small firms of 1–10 lawyers who cannot afford a full-time receptionist but cannot afford to miss calls either.
Common configurations:
- After-hours only: calls diverted to ZvonAI outside 9am–5pm
- Overflow: ZvonAI picks up when all lines are busy
- Full reception: ZvonAI handles all calls; lawyer reviews transcripts and calls back within a defined window
Each configuration is compliant with GDPR as described in this guide. Each requires a signed DPA and the recommended update to your Records of Processing Activities.
Next Steps
If you want to explore ZvonAI for your kancelaria, start here:
- Review how ZvonAI works: jak-dziala
- Request a law firm DPA template: email dpo@zvonai.ai with subject "Law firm DPA request"
- Join the waiting list: waitlist
Questions about GDPR compliance, sub-processors, or specific data handling scenarios — our DPO team responds within one business day.
ZvonAI is a product of Expathia Sp. z o.o., NIP 5882532485, ul. Bolesława Krzywoustego 8, 81-035 Gdynia. Data protection enquiries: dpo@zvonai.ai
See how ZvonAI works — jak-dziala
Reserve your place — join the waiting list: waitlist