Can you prove consent for AI call recording and other AI features? A GDPR Article 7 consent record sheet for small businesses
What you get: a finished Article 7 consent record sheet: one row per AI purpose that relies on consent (for example recording and transcribing customer calls, using client photos in AI-edited marketing, AI chatbot follow-up messages), one column per consent check from Articles 7, 8 and 9, a result formula that counts failed checks, three made-up example rows, a per-person log layout and a withdrawal routine.
Short answer: if you rely on consent, Article 7(1) GDPR says you must be able to demonstrate it. That means keeping the exact wording you used, which version each person agreed to, when and how, and making withdrawal as easy as saying yes. A pre-ticked box or a line buried in your terms does not count.
Step 1: is consent the right basis for this AI use?
- Consent is one of six lawful bases in Article 6(1). If the AI use is needed to deliver what the customer asked for, or you can pass a legitimate interest assessment, another basis may fit better. Do not ask for consent you would ignore if refused.
- Typical consent cases for small businesses: recording calls for AI transcription, using a client's photo or voice in AI-made marketing, sending AI-personalised marketing messages, and using customer chats to train a tool.
- Recording calls can also fall under national telecom or recording laws. Check your country's rules as well as the GDPR.
Step 2: the consent record sheet (one row per AI purpose)
| Column | What to write | Source |
|---|---|---|
| A. Purpose and AI tool | [purpose, e.g. record and transcribe sales calls] · [AI tool] · lawful basis = consent (Art. 6(1)(a)); if a different basis fits better, note it and leave this sheet | Your AI register entry; Art. 6(1) |
| B. Consent wording and version | Exact text shown or read out, version number and date, and where it appears (call script, web form, paper form) | Art. 7(1) |
| C. Informed | Y / Partial / N: the wording names your business, the purpose, what data is used, that the person can withdraw at any time, and any automated decisions or transfers outside the EU that apply | Art. 7(3) third sentence; Recital 42; EDPB 05/2020 section 3.3 |
| D. Separate from other terms | Y / N: the consent request stands apart from terms and conditions and other matters, in clear and plain language | Art. 7(2) |
| E. Active opt-in | Y / N: the person ticks, clicks, signs or says yes; no pre-ticked box, no silence, no "by continuing you agree" | Art. 4(11); Recital 32 |
| F. Not a condition of service | Y / N: the person gets the service even if they say no, unless the processing is really needed for that service | Art. 7(4); Recital 43; EDPB 05/2020 section 3.1 |
| G. One purpose per yes | Y / N: separate yes or no for each purpose (for example transcription and using the recording to train the tool are two questions) | Recital 32; EDPB 05/2020 section 3.2 |
| H. Withdrawal as easy as giving | Y / N: the same channel works to withdraw (say it on the next call, untick in the account, reply to an email), and the withdrawal route is written down | Art. 7(3); EDPB 05/2020 section 5.2 |
| I. Record per person | Y / N: for each person you can show who, when, how and which wording version they agreed to | Art. 7(1); EDPB 05/2020 section 5.1 |
| J. Children (online services) | Y / N / Not relevant: if you offer an online service directly to children, the age threshold is 16 unless your country set a lower age (not below 13); below that age, parental consent with reasonable checks | Art. 8(1) and 8(2) |
| K. Special category data | Y / N / Not relevant: if health, biometric or other special category data is involved (clinic calls, voice ID), consent must be explicit, for example a signed or clearly stated yes to that specific use | Art. 9(1) and 9(2)(a); EDPB 05/2020 section 4 |
| L. Result | =IF(COUNTIF(C2:K2,"N")>0,"Fix: "&COUNTIF(C2:K2,"N")&" check(s) failed",IF(COUNTIF(C2:K2,"Partial")>0,"Check wording","Consent record OK")) | Art. 7 |
| M. Action, owner, date | [rewrite wording / add separate tick box / add withdrawal route / start per-person log / switch to another lawful basis / stop the use] · [role] · [dd/mm/yyyy] | Art. 5(2) accountability |
Put Y, Partial or N in columns C to K (Not relevant where it does not apply; the formula ignores it). Sort by column L so the rows to fix come first.
Step 3: the per-person log (second tab)
One row per person per purpose: person ID (customer number, not a copy of their file) · purpose (matches column A) · wording version (matches column B) · date and time · how given (ticked web form, said yes on recorded call at 00:12, signed form) · withdrawn on · data deleted or basis changed on. Keep only what you need to show consent; the EDPB says the record itself should not lead to excessive extra processing.
Three example rows (made-up businesses, for illustration only)
Example row 2, a small insurance broker, "Example AI call transcriber": A. record and transcribe client calls for notes · B. script v2, read at the start of each call, 01/10/2026 · C. Partial: no mention of withdrawal · D. Y · E. Y, client says yes · F. Y, calls go ahead unrecorded if they say no · G. N: same yes also covers "improving the AI service" · H. Y · I. Y, the yes is on the recording · J. Not relevant · K. Not relevant · L. Fix: 1 check(s) failed · M. split the training use into its own question and add "you can ask us to stop recording at any time"; owner: office manager.
Example row 3, a physiotherapy clinic, "Example AI scribe" for consultations: A. record consultations to draft clinical notes · B. none, mentioned only in booking terms · C. N · D. N · E. N · F. N: booking requires accepting the terms · G. N · H. N · I. N · J. Not relevant · K. N: health data needs explicit consent if consent is the basis · L. Fix: 8 check(s) failed · M. stop recording until a separate signed consent form and patient log are in place, and check the Article 9 health data sheet.
Example row 4, a hair salon, "Example AI photo editor" for before-and-after posts: A. edit client photos with AI and post on social media · B. tick box v1 on the aftercare form, 15/09/2026 · C. to I. all Y · J. Not relevant (no online service for children) · K. Not relevant · L. Consent record OK · M. review wording yearly; owner: salon manager.
Withdrawal routine
- Same channel: if consent was given on a call, a yes on a later call or a reply email withdraws it; if given by tick box, the untick must be just as easy (Article 7(3)).
- Stop and log: stop the processing that relied on consent, note the date in the per-person log, and tell the AI supplier if it holds the data.
- Delete or switch basis: where no other lawful basis applies, delete the data (Article 17(1)(b)). Use the erasure and objection request sheet to track it.
- Earlier processing stays lawful: withdrawal does not undo processing done before it (Article 7(3)).
Do this week
- List each AI use that relies on consent once in your register and add one row per purpose here
- Copy the exact consent wording into column B and give it a version number
- Fill columns C to K and fix every row marked Fix
- Start the per-person log for new consents from today
- Make sure your privacy notice AI section matches the consent wording
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4(11), 6, 7, 8, 9 and 17 and Recitals 32, 42 and 43, as published on gdpr-info.eu) and the EDPB Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1. Example rows are made up for illustration and do not describe any real business or supplier. Checked on 24 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who start recording calls or posting AI-edited client photos rarely keep consent records. Hand them this sheet with the client AI inventory so the decision and wording are written down. Stay inside your professional rules and refer legal questions on.
Keep the answer next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and attach its consent wording and check row as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: legitimate interest assessment · AI meeting note-taker setup · Article 30 records · Article 28 DPA clause check
Sources
- Article 7 GDPR, Conditions for consent (with Article 8, Article 9 and Article 17); official text: Regulation (EU) 2016/679
- EDPB Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.